Recovering lost files

Recovering lost files

Post by BPSU » Fri, 08 Sep 2000 17:39:05



Hi there,

Whe are working on a case to detect fraud where the Unix sysadm presumably
covered his tracks by deleting the log files. Could someone please tell me
if there is a way to recover the log files or the reconstruct the inodes or
something presuming that the data on the ard drive has not been overwritten
with zero's. We are in possession of the hard drive.

Thanks

Jaco Cloete

 
 
 

Recovering lost files

Post by Chris Gree » Fri, 08 Sep 2000 20:40:14


Hi,

well it really depends. Theoretically, no, it's not possible. In practice,
it might be.

The first thing to identify is what sort of Unix we're talking about...

The second thing is, what sort of tools do you have available?

The reason I ask is, if you have the time and the tools to do it, you could
probably boot from a MS-DOS (!) floppy, and run Norton Utilities Disk
Editor. Access the drive as a physical unit, and then theoretically anything
actually on the drive that hasn't been overwritten will be there - once you
find it of course... I'd suggest searching for a string that'd likely appear
in the syslog normally.

If you were feeling really ambitious, you might be able to manually
reconstruct the inodes. Just don't ask me to do it :)

regards
Chris
Brainbench MVP for Internet Security


Quote:> Hi there,

> Whe are working on a case to detect fraud where the Unix sysadm presumably
> covered his tracks by deleting the log files. Could someone please tell me
> if there is a way to recover the log files or the reconstruct the inodes
or
> something presuming that the data on the ard drive has not been
overwritten
> with zero's. We are in possession of the hard drive.

> Thanks

> Jaco Cloete


 
 
 

Recovering lost files

Post by Julian Midgl » Fri, 08 Sep 2000 22:49:31




>Hi,

>well it really depends. Theoretically, no, it's not possible. In practice,
>it might be.

>The first thing to identify is what sort of Unix we're talking about...

>The second thing is, what sort of tools do you have available?

There are in fact several things you may be able to do.  The very
first, if you haven't done it already, is to unmount the partition
concerned and ensure that it isn't used on a live system again until
you have either recovered the data or satisified yourself that it's
unrecoverable.

Having done that, you will want to employ a tool that understands the
particular filesystem you are using, and is able to retrieve
unattached inodes.  On Linux, debugfs is the tool you want.  See its
man page for details of use.

You may find the filesystems HOWTO useful at:

http://metalab.unc.edu/pub/Linux/docs/HOWTO/Filesystems-HOWTO

All the best,

Julian Midgley

--
Julian Midgley

Zeus Technology Ltd                     http://www.zeus.com

 
 
 

Recovering lost files

Post by elle.. » Sat, 09 Sep 2000 03:59:38



> well it really depends. Theoretically, no, it's not possible. In practice,
> it might be.

What?! Assuming there haven't been any modifications to the
filesystem, theoretically it's trivial. Possible solutions include:

1. Reading the device directly, and assembling the unallocated pieces
   by hand.
2. Reading/Writing the device and relinking interesting blocks by hand.
3. Reading the device directly, and relinking interesting inodes.
3. Using actual software, and following the directions.

[Horrible Dos suggestion snipped]

Quote:> If you were feeling really ambitious, you might be able to manually
> reconstruct the inodes. Just don't ask me to do it :)

Indeed, given that it's somewhat important to recover the data I
suggest you either hire a competant consultant for a day, or employ a
reputable data-recovery firm.

--

 
 
 

Recovering lost files

Post by d » Sun, 10 Sep 2000 14:44:20




> >Could someone please tell me
> >if there is a way to recover the log files or the reconstruct the inodes

> In general, reconstructing deleted files from a UNIX-like file system
> is exceptionally difficult if not impossible.

It doesn't have to be.  Indeed, as you say, recovering log files are greatly
simplified by the regularity of the time stamps.  I'd suggest using unrm and
lazarus to try and recover the stuff (from TCT); depending on how the files
were killed off, how long ago it was, and what has happened since, you
have a decent chance of getting something:

        http://www.fish.com/tct
        http://www.porcupine.org/forensics

-- d

 
 
 

1. recovering lost file

Hi,
My computer rebooted accidentally while it was running linux yesterday
and when I rebooted the file system was corrupted. I ran 'fsck'
and this helped me start it again but the file I was working on
along with the directory was gone. I was reading the 'faq'
that was posted this morining and tried a 'grep -b 'string' /dev/hda'
on the partition but it says 'grep: memory exhausted'. I would
appreciate
any suggestions on recovering the file.

Thanks,
Rajnish

2. Manage users in laptop environment?

3. Timely thread! Recovering lost files.

4. rmap VM 13b

5. Recovering lost file system: how?

6. No BIOS32 ????

7. how do I recover files in lost+found dir ?

8. "Back Up the System" trough smit crashes system AIX 4.1.2

9. recovering lost+found files?

10. Recover files from lost+found

11. HELP: recovering lost disk files

12. Recovering /lost /usr partition - The final verdict

13. recover lost disk....