Re: recovering deleted file from /tmp

[email protected] (Wietse Venema) Mon, 7 Jul 2003 15:03:23 -0400 (EDT)

Newsgroups	gmane.comp.security.forensics.tct
Message-ID	<[email protected]>

Nikko Odiseos:
> Need to recover a deleted file from /tmp (swap) after the system was
> rebooted but I think I may be hosed.

If your machine has enough memory the file was never written to
disk. It just stayed in memory. Unfortunately, many PC bioses will
reset all RAM upon reboot.

> [root@oasis:/usr/tct-1.11/bin]$
> $ ./unrm /dev/dsk/c0t2d0s1 > /usr/nikko/unrm_ouput
> ./unrm: /dev/dsk/c0t2d0s1: bad magic number in superblock
> 
> Is it possible to recver from a swap partition?

SWAP partitions have no file system structure. You can try to
recover material with "strings" or with "lazarus".

	Wietse