Deleted File Recovery Through SSH

[Matthew Frederico]

The only way you can recover deleted files (in my experience) is to
either dump and look at the /proc/kcore file (which is impossible in
FC) or to cat your whole HD to and grep through it for known content.

e.g.: # cat /dev/hda1 | grep "deleted.file"

These aren't eve sure fire ways, but it has helped me in the past
recover some files.

-- Matt



On Mon, 14 Feb 2005 14:37:13 -0700, Davis, Lawrence
<Lawrence.Davis at caselle.com> wrote:
> Hello All,
> 
>         How would I go about recovering deleted files through ssh? What
> tools can I upload to do this for me? I have no physical access to the
> server, so everything is done through ssh and scp. I'm not sure what cmd was
> executed to delete the files as it appears the server was hacked.
> 
> Thanks,
> 
> Lawrence Davis
> 
> .===================================.
> | This has been a P.L.U.G. mailing. |
> |      Don't Fear the Penguin.      |
> |  IRC: #utah at irc.freenode.net   |
> `==================================='
> 


-- 
-- Matthew Frederico
http://www.ultrize.com