cgsecurity.org

Hello, would appreciate your help.

I deleted lots folder (oracle database files) and tried to undelete it on solaris 10.
root@tderbtdb1b # uname -rap
SunOS tderbtdb1b 5.10 Generic_144488-14 sun4u sparc SUNW,Sun-Fire-V890
root@tderbtdb1b # cat /etc/release
Oracle Solaris 10 9/10 s10s_u9wos_14a SPARC
Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
Assembled 11 August 2010

1. Does TestDisk support Sun OS?
The main page Operating systems support SunOS but the document explains how to compile TestDisk and PhotoRec doesn't have SunOS. I could find System specific notes and installation guide for Solaris

2. If TestDisk could undelete files, could you please guide me where can i find the installation guide for undelete files?
I tried to install TestDisk by testdisk-7.0-WIP.linux26-x86_64.tar.bz2 packet on solaris but got stuck on ./configure and make
I don'k know how execute TestDisk on solaris. It looks the OS couldn't recognize user:group id on TeskDisk folder.
root@tderbtdb1b # ls -lrt
total 37616
drwxr-xr-x 2 noaccess noaccess 177 May 14 2013 hsperfdata_noaccess
drwxr-xr-x 2 root root 117 May 14 2013 hsperfdata_root
drwxr-xr-x 2 oracle oinstall 117 Apr 11 2014 hsperfdata_oracle
drwxr-xr-x 5 1000 1000 1499 Apr 6 01:54 testdisk-7.0-WIP

Thanks,
Anderson

As a user, download and decompress TestDisk source (not linux) file. Once it's done, compile it using "./configure && make" and next as root, run PhotoRec.

If you are using raidz, you need to extract the free space by using "zdb -m" and some scripting. Next, run photorec on the file have created with the free space content. Be carefull to not store more information on the partition where the files were.

cgrenier wrote: ↑09 Apr 2015, 07:08 As a user, download and decompress TestDisk source (not linux) file. Once it's done, compile it using "./configure && make" and next as root, run PhotoRec.

If you are using raidz, you need to extract the free space by using "zdb -m" and some scripting. Next, run photorec on the file have created with the free space content. Be carefull to not store more information on the partition where the files were.

Sorry to revive an old thread, but I found it very relevant.
Would you be able to provide a bit more guidance in to how this step may be performed?

I know the offset and spacemaps based on the zdb -m command, but what command/tool can be used next?