1
vote
0answers
21 views

How can I unveal files on my external hard drive?

I copied a big folder (around 110 GB) from my (Mac 10.7.5) computer onto a hard drive (exFAT). It took quite some time and afterwards I even checked that the files were actually there. After more ...
0
votes
1answer
29 views

Mount a file collection in a linux environment

I am presently working as a summer intern. My first objective is, given a collection of files, recover and identify the file types present in it. To download sample pseudo-forensics data I have been ...
2
votes
2answers
2k views

undelete a just deleted file on ext4 with extundelete

Is there a simple option on extundelete how I can try to undelete a file called /var/tmp/test.iso that I just deleded? (it is not so important that I would start to remount the drive read-only or ...
2
votes
1answer
64 views

How to link the unlinked files?

When you rm a file it will call unlink(), and unlink() will remove the file from the Directory entry and its inode is freed. But, the actual content of the file is still in the disk. Is there any way ...
4
votes
1answer
84 views

How to know what files got deleted?

I'm working on Ubuntu 13.04. yesterday from a Windows 7 partition, I accidentally deleted many files. I deleted by pressing shift-del. Is there any way to know the name of the files that got ...
1
vote
0answers
366 views

How to recover: Deleted accidently important files [duplicate]

I've accidentally deleted today the /var/www with 2 Joomla-Homepages on it. Is there any possibility to recover all these files? I'm using PhotoRec right know, but the recovered files are named like: ...
1
vote
1answer
419 views

Getting back rsync's deleted files [duplicate]

I accidentally rsync-ed to a server using the delete attribute when I shouldn't have. Is there any chance of getting the data on the server that rsync removed.. back?
0
votes
3answers
550 views

Rm command recovery for this situation

İn my desktop, i have a dir. called exam, and i wanted to remove it from the console and wrote rm * /exam, and apparently it removed some other files from my desktop. Please tell me that there is a ...
2
votes
1answer
115 views

View temporary files which exist for milliseconds

I'm trying to debug a program which is not logging the information I need. Fortunately, it does write temporary files which should contain the information. These files are written to a directory like: ...
0
votes
2answers
2k views

How to find last deleted files on OpenSuse?

I didn't lock the screen on my OpenSuse Linux and let my girlfriend do all evil things when I was sleeping. Is there a way to find out if she deleted any files from my PC? I was looking at the "Date ...
2
votes
1answer
132 views

How to run a command against all the files of particular types on a filesystem?

I've just recovered tons of files (distributed in a complex directory structure, having very long names, using Unicode symbols, spaces etc in names) from a damaged hard drive. Now I'd like to verify ...
4
votes
1answer
2k views

How to decrypt single EncFS encrypted files?

Is it possible to decrypt single EncFS encrypted files with access to .encfs6.xml configuration file and without the proper directory structure it was created? With a little help from google I found ...
8
votes
3answers
2k views

File is mysteriously empty. Options to recover?

I have seen several posts about recovering deleted files, but this situation is different. My wife had a file called Journal.odt in which she kept a lot of important personal information such as ...
2
votes
2answers
222 views

Is there a way to undo the 'cpp' command in terminal?

I accidentally typed cpp Scriptname.py DestinationDirectory, intending to copy the Python script into the folder. I realized afterward that I should have used cp, but now my Python script is ...
4
votes
1answer
625 views

Restoring an open file

I have an interesting problem which may or may not have a solution but I'd love to have one if possible: On Solaris an open log file has been removed, which still continues to be populated while the ...
4
votes
2answers
784 views

undelete files from local fileserver

I have a NAS (mybook world white light) in my living room where all my music and stuff is stored. I've mounted the music folder of the nas in the local music folder of my home directory on my desktop ...
2
votes
1answer
192 views

Prevent libflashplayer.so from deleting a file?

I'm trying the preview release of Flash Player "Square" for Linux and noticed that video files are now being deleted from the /tmp/ folder. Yet the files are still in use (I can see them with lsof): ...