HELP: want to recover /usr/local

Robert G. (Doc) Savage dsavage at peaknet.net
Tue Oct 5 23:53:53 UTC 2004


On Mon, 2004-10-04 at 00:52, Sathish S. Vadhiyar wrote:
> Hi,
> 
> I accidentally removed /usr/local on a machine. This was where I was
> having all 3rd-party software. Moreover this was serving as NFS filesystem
> for other machines in my cluster. I still haven't rebooted the system. Is
> there any magical way in fedora to restore the directory? ANy help will be
> GREATLY appreciated.

Satish,

What you really need is the help of a computer forensics analyst,
preferably one who has successfully completed the SANS Track 8 course.

However, if someone with those skills is not available and you must do
it yourself, you will need The Sleuth Kit set of tools (specifically the
icat tool) from http://sleuthkit.sourceforge.net. Be advised that these
are powerful -- and unforgiving -- tools. Used incorrectly they can do
very serious damage to your system. There is a web front-end to TSK
called Autopsy that makes recovery (or total destruction) a lot easier.

Two other tools you might also use are lazarus and foremost
(http://sourceforge.net/projects/foremost). If any of the file types you
are trying to recover are not recognized by the 'files' utility, check
http://www.wotsit.org and add their header specs to the foremost.conf
file.

Good luck.

-- Doc 
Robert G. (Doc) Savage, BSE(EE), CISSP, RHCE | Fairview Heights, IL
Fedora Core 1 kernel 2.4.22-1.2199.nptl on P-III/M IBM Thinkpad A22p
"Perfection is the enemy of good enough."
                         -- Admiral of the Fleet Sergei G. Gorshkov




More information about the fedora-list mailing list