[sleuthkit-users] Undelete

[Zach A. <and...@gm...>]

I'm not quite sure if I'm reading the description pages correctly or not, so
I thought I'd post a question here.  I've committed a cardinal sin by
somehow accidentally running a rm -r on our entire repository running on a
Solaris 8 Blade server.  I have isolated the disk and have tried running a
couple of recovery programs with not much luck.  It's on a ufs partition and
we have loaded tct on another partition and have successfully retrieved a
"unrm" dump.  Now my question is, can SleuthKit and Autopsy help me to
retrieve and undelete these source files and more importantly the version
history ,the ",v" files?   I think I've finally learned my lesson and from
this moment forward in my career, it's backup, backup, backup no matter how
small or large.

Thanks,

Zach