summary (recover from rm)

From: Sean Higdon (sean_higdon@yahoo.com)
Date: Mon May 22 2000 - 11:46:04 CDT


Thanks to:

Art Lehmann
Birger Wathne
Bill Armand
Kenneth Weschler
Litwin, Gary
Joel Turoff
Perrier,Kent
Jay Lessert
Ilhan Narli
Kevin Colagio

I found a company on the internet who said they could do it.
We have not tried to use them, but here is the information
I found out.

this is for 18gig disk with solaris 2.6 & veritas:
( i have to ship the disk to their lab back east )
    
    24 hrs evail disk ($300)
    72 hrs to recover data (usualy cost $2,000 -> $4,000; worst case $9,000)

The person on the phone said they had a very high recovery rate.

Sean Higdon
-------------------------------------------------------------------------------
from Art:

         Well I kinda did something like this many
many years ago with Sun
OS 4.0.3 - anyway it's
too late for you now I;m sure....

Stop all activity on said filesystem (i.e. run fuser
and kill all processes
running using that filesystem)
umount filesystem - if you can..., if you can't drop
to single user mode
with init.
YOU CAN ONLY GET ASCII FILE DATA WITH THIS....
assuming that you still have a useable system, using
your xwindow server
and 2 xterms
in 1st xterm cat the "raw" disk partition and pipe it
though more....
in 2nd xterm open a "recover" file in vi...
spend the next ? many hours cutting from xterm 1 and
pasting into xterm 2
the data that "looks" important.

When I did this it was at a time when I supported a
code base of
programmers and I had their assistance
(over my shoulder) telling me what I should and should
not save....

Other than that I have seen several write-ups in some
of the Unix Admin
trades that have contests on this problem...
try doing a web search on "unix recovery after rm -r"
or something like that...

                                         ArtMan

-------------------------------------------------------------------------------
from Birger Wathne:

You should dismount the file system as soon as
possible, as the last
freed blocks are most likely to get reused in a ufs
file system.

In Europe, look at http://www.ibas.no/ for a company
that has a lot of
knowledge and equipment. They can read several
generations of
overwritten data off the disk if neccesary, but it
gets expensive. They
have customers sending disks from the US as well.

http://www.ibas.no/products/recovery.html takes you
directly to the info
about data recovery. These guys are used by insurance
companies, police,
military units, etc.

If you give them a call they may be able to recommend
someone closer to
you.

Birger

__________________________________________________
Do You Yahoo!?
Send instant messages & get email alerts with Yahoo! Messenger.
http://im.yahoo.com/



This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:14:08 CDT