Deleted File Recovery Through SSH
mfrederico at gmail.com
Tue Feb 15 06:42:59 MST 2005
The only way you can recover deleted files (in my experience) is to
either dump and look at the /proc/kcore file (which is impossible in
FC) or to cat your whole HD to and grep through it for known content.
e.g.: # cat /dev/hda1 | grep "deleted.file"
These aren't eve sure fire ways, but it has helped me in the past
recover some files.
On Mon, 14 Feb 2005 14:37:13 -0700, Davis, Lawrence
<Lawrence.Davis at caselle.com> wrote:
> Hello All,
> How would I go about recovering deleted files through ssh? What
> tools can I upload to do this for me? I have no physical access to the
> server, so everything is done through ssh and scp. I'm not sure what cmd was
> executed to delete the files as it appears the server was hacked.
> Lawrence Davis
> | This has been a P.L.U.G. mailing. |
> | Don't Fear the Penguin. |
> | IRC: #utah at irc.freenode.net |
-- Matthew Frederico
More information about the PLUG