[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[no subject]
- <!--x-content-type: text/plain -->
- <!--x-date: Thu Jun 9 13:28:22 2005 -->
- <!--x-from-r13: obo ng irelfrpheryvahk.pbz (Pbo Fbkra) -->
- <!--x-message-id: [email protected] -->
- <!--x-reference: 0F36D940-5B83-4F3E-977F-[email protected] -->
- <!--x-reference: Pine.LNX.4.44.0506081716180.14152-[email protected] --> "http://www.w3.org/TR/html4/loose.dtd">
- <!--x-subject: [ale] Drive recovery -->
- <li><em>date</em>: Thu Jun 9 13:28:22 2005</li>
- <li><em>from</em>: bob at verysecurelinux.com (Bob Toxen)</li>
- <li><em>in-reply-to</em>: <<a href="msg00388.html">[email protected]</a>></li>
- <li><em>references</em>: <<a href="msg00349.html">[email protected]</a>> <<a href="msg00388.html">[email protected]</a>></li>
- <li><em>subject</em>: [ale] Drive recovery</li>
After a client accidentally did "rm -rf /" as root, it tooke me a week
to recover 90% of his important files.
Btw, if one accidentally does this, the correct action is to immediately
hit the reset button or yank the power cord, whichever can done the
quickest. The ext2/3 file system has enhancements to the inode
structure (over the basic Unix inode) that makes such recovery easier.
During forensics one frequently can recover data long "removed".
Bob Toxen
<a rel="nofollow" href="http://www.verysecurelinux.com";>http://www.verysecurelinux.com</a> [Network&Linux/Unix security consulting]
Quality Linux & UNIX security and SysAdmin & software consulting since 1990.
"Microsoft: Unsafe at any clock speed!"
-- Bob Toxen 10/03/2002
> On Wed, 8 Jun 2005, Mark Wright wrote:
> > I have seen advertisments that claim to recover any drive but the
> > cost is incredible. Maybe the data security issue is a bit in the
> > paranoid camp. It is better to err on the side of caution but does
> > this "king have no clothes"?
> >
> >
> > On Jun 8, 2005, at 10:28 AM, Nathan J. Underwood wrote:
> >
> > > Mark,
> > >
> > > I'm glad that I'm not the only one struggling with this. I've
> > > had a number of occasions where I've accidentally deleted something
> > > (not 'secure' deleted it, mind you), and had little or no success
> > > getting it back. I've since been looking for this easy way that I
> > > had assumed everyone but me knew to recover files that weren't
> > > deleted securely.
> > >
> > > Mark Wright wrote:
> > >
> > >
> > >>
> > >> I have a drive that I would like to recover data from. Reading
> > >> the discussion about secure deleting of data was making me
> > >> think. This drive has nothing wrong except the table of contents
> > >> can't be read and I cannot find any program or technique to read
> > >> any data off it. If this is a security problem why isn't it
> > >> easier to read a damaged disk?
> > >>
> > >> I purchased a program called Data rescue that has saved
> > >> unreadable zip disks for me but it cannot decode the data on this
> > >> disk. Data rescue reads blocks of data into memory and compares
> > >> it to known format until it recognizes something. I have let it
> > >> run for weeks with no success. I suppose too much formatting
> > >> info is missing. I know the data is laying out there to be
> > >> read. Anyone know of any utilities to examine bits on a disk?
> > >> This is a Mac OS9 formatted disk, if it makes any difference.
> > >>
> > >> If it is this hard to pull any data off a corrupt disk I would
> > >> say that writing random data all across a hard drive to secure
> > >> delete is a waste of time. Nobody would go through what I have
> > >> gone through to read this disk on a used purchase or a salvage
> > >> disk if they did not know something valuable was there.
> > >>
> > >> Mark
> > >> _______________________________________________
> > >> Ale mailing list
> > >> Ale at ale.org
> > >> <a rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
> > >>
> > >
> > > _______________________________________________
> > > Ale mailing list
> > > Ale at ale.org
> > > <a rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
> > >
> >
> > _______________________________________________
> > Ale mailing list
> > Ale at ale.org
> > <a rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
> >
>
> --
> =============================================
> If you think Education is expensive
> Try Ignorance
> Author Unknown
> ============================================
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> <a rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="00349" href="msg00349.html">[ale] Drive recovery</a></strong>
<ul><li><em>From:</em> mpwright at speedfactory.net (Mark Wright)</li></ul></li>
<li><strong><a name="00388" href="msg00388.html">[ale] Drive recovery</a></strong>
<ul><li><em>From:</em> tfreeman at intel.digichem.net (tfreeman at intel.digichem.net)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00423.html">[ale] ssh authorized_keys2, what am I missing?</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00425.html">[ale] Dvorak Says</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00395.html">[ale] Drive recovery</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg00350.html">[ale] Drive recovery</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00424"><strong>Date</strong></a></li>
<li><a href="threads.html#00424"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>
<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>