folder deleted, how to retrieve it and files in it.

ali ali <[email protected]> Wed, 20 Jul 2005 22:26:05 +0400
Newsgroups gmane.comp.security.forensics.tct
Message-ID <[email protected]>
hello.

FreeBSD5.x UFS2

i accidintly deleted 'www' folder - apache's root directory. all my
dynamic pages and perl scripts i wrote are gone now.

bin/unrm /dev/ad0s1f  >  /store/unrm_outpot

 /dev/ad0s1f is /usr parition which had the 'www' folder in.
 /store/unrm_outpot is located on a separat disk with lots of more
space (80GB while ad0s1f is less than 17GB).

I run this command:-
bin/unrm /dev/ad0s1f  >  /store/unrm_outpot

its now coppying files into 'unrm_output' taking lots of time. the
question is, how will I find my folder and all its files in? is TCT
designed to retrieve file by file only? Is there any way to retrieve a
deleted folder with all of its subfolders and files?  and please how.


thanks in advance.
Ali