Re: deleted logfiles
Andrew Stribblehill <[email protected]> Thu, 3 Apr 2003 09:35:38 +0100
| Newsgroups | gmane.comp.security.forensics.tct |
|---|---|
| Message-ID | <20030403083538.GF18211@wompom> |
Quoting Callan, Chris <[email protected]> (2003-04-01 08:00:38 BST): > I accidentilly deleted some log files, do I have to install tct to try and > get them back? If your OS is still writing to them, you _may_ be able to recover them 'live'. On Linux, you can go into /proc/<pid>/fd and see what you find there. Otherwise, tct is a jolly good answer. Make sure you install TCT onto a different partition to the one containing the deleted logfiles. -- VIKING NORTH UTSIRE NORTH BACKING SOUTHWEST, VEERING NORTHWEST LATER, 5 OR 6, DECREASING 4 FOR A TIME. OCCASIONAL RAIN OR DRIZZLE. GOOD BECOMING MODERATE