How to recovery deleted files?

[James Wilkinson]

BB Cao wrote:
> Hi All,
>
> I accidently delete all my files under a directory by
> using "rm *". Are there any way recoverying them?
> Thanks.

Gavin Henry wrote:
> http://www.sleuthkit.org/

BB Cao replied:
> Thanks! Any other tips since I am a normal user
> without root authority and the su is out of town for
> weekend?

Probably a bit late now, but turn the computer off. Don't allow those
disks to be remounted until something like sleuthkit has been run.

If you have physical access to the machine, you may be able to run
sleuthkit from a CD-based OS like Knoppix, or take the hard drive out,
put it into another PC, and make *very* sure that you're NOT booting
from the hard disk with deleted files.

If you continue to use the disk, then the deleted files will
increasingly be overwritten by other stuff that is being saved. And then
it will be practically impossible to get the data back.

Some Data Recovery firms claim to be able to recover overwritten data. I
seem to remember someone from an IT website tested them, and found that
their success rate was practically nonexistent. I can't find a link at
the moment.

Your only other option is to convince your national authorities that you
are an Al Qaeda operative. Hopefully they or someone like the NSA will
attempt to recover everything they can from the drive (and if anyone can
recover over-written data, they can). When they find that there is
nothing suspicious there, you *may* be able to convince them to give you
a copy of the data. If you are *amazingly* persuasive...

Good luck!

James.

-- 
E-mail address: james | Q. "Why can't I print?"
@westexe.demon.co.uk  | A. "Because you're not a printer."
                      |     -- Stephen Judd