Re: recovering deleted file from /tmp

Wietse Venema:
> Nikko Odiseos:
> > Need to recover a deleted file from /tmp (swap) after the system was
> > rebooted but I think I may be hosed.
> 
> If your machine has enough memory the file was never written to
> disk. It just stayed in memory. Unfortunately, many PC bioses will
> reset all RAM upon reboot.
> 
> > [root@oasis:/usr/tct-1.11/bin]$
> > $ ./unrm /dev/dsk/c0t2d0s1 > /usr/nikko/unrm_ouput
> > ./unrm: /dev/dsk/c0t2d0s1: bad magic number in superblock
> > 
> > Is it possible to recver from a swap partition?
> 
> SWAP partitions have no file system structure. You can try to
> recover material with "strings" or with "lazarus".

Likewise, if your memory wasn't wiped upon reboot, you may be able
to recover something from /dev/mem.

Time for me to finish the mempory dumping tool for *NIX systems.

	Wietse