sleuthkit-users

[sleuthkit-users] help needed by a verynewbie

[vattini g. <ha...@ya...>]

I hope that someone could helpme.
So this was the situation from my partition
/franzi/franzi i deleted two files faq1.html faq2.html

transleted in italian i do not no how to having them
back.So i will appriciate very much for help
My situation
So OpenBSD3.5 
disklabel wd0
cylinders: 16383
total sectors: 58605120
rpm: 3600
interleave: 1
trackskew: 0
cylinderskew: 0
headswitch: 0           # microseconds
track-to-track seek: 0  # microseconds
drivedata: 0 

16 partitions:
#        size   offset    fstype   [fsize bsize   cpg]
  a:  1638000 24161760    4.2BSD     2048 16384   328 
 # (Cyl. 23970 - 25594)
  b:   614880 25799760      swap                      
 # (Cyl. 25595 - 26204)
  c: 58605120        0    unused        0     0       
 # (Cyl.    0 - 58139)
  d:  4095504 26414640    4.2BSD     2048 16384   328 
 # (Cyl. 26205 - 30267)
  e:  7167888 30510144    4.2BSD     2048 16384   328 
 # (Cyl. 30268 - 37378)
  f:  1433376 37678032    4.2BSD     2048 16384   328 
 # (Cyl. 37379 - 38800)
  g:  1638000 39111408    4.2BSD     2048 16384   328 
 # (Cyl. 38801 - 40425)
  h:  5983672 40749408    4.2BSD     2048 16384   328 
 # (Cyl. 40426 - 46362*)
  i: 16386299       63   unknown                      
 # (Cyl.    0*- 16256*)
  k:  7036469 16386363    ext2fs                      
 # (Cyl. 16256*- 23236*)
  l: 11872035 46733085    unused        0     0       
 # (Cyl. 46362*- 58139)
df=
Filesystem  512-blocks     Used    Avail Capacity 
Mounted on
/dev/wd0a      1611884    90244  1441048     6%    /
/dev/wd0h      5884532   311092  5279216     6%   
/franzi
/dev/wd0f      1407260       16  1336884     0%   
/tmp
/dev/wd0e      7053100  4078776  2621672    61%   
/usr
/dev/wd0g      1611884    22656  1508636     1%   
/var
So i think i need some image of wd0h where is
/franzi/frazi but i think the space is not enough
which command do i have to digit ?I'm lost i just make
install about the programm sleuthkit
thanks christian



		
___________________________________ 
Nuovo Yahoo! Messenger: E' molto più divertente: Audibles, Avatar, Webcam, Giochi, Rubrica… Scaricalo ora! 
http://it.messenger.yahoo.it

Re: [sleuthkit-users] help needed by a verynewbie

[Brian C. <ca...@sl...>]

OpenBSD wipes the block pointers in the inode when it deletes a file, 
so there isn't much you can do for recovery. Your best bet is to do 
some keyword searching on the partition for words that you know are in 
the files.

brian


On Oct 22, 2004, at 6:57 AM, vattini giacomo wrote:

> I hope that someone could helpme.
> So this was the situation from my partition
> /franzi/franzi i deleted two files faq1.html faq2.html