Deleted files using rm -rf /

Using TestDisk to undelete files
Post Reply
Message
Author
ragnazorg
Posts: 5
Joined: 21 Mar 2012, 12:51

Deleted files using rm -rf /

#1 Post by ragnazorg » 21 Mar 2012, 12:54

What happened was my server got compromised.

The hacker did rm -rf /

which resulted to my files being deleted.
I want to restore the files from a user.
Im running in debian squeeze in Xen Server. I have a Vritual drive which it is installed. Now im wondering how can I restore or check the certain files I need. Some files I need are mostly 300mb++ in size.

is it possible to restore them?

Sponsored links

User avatar
cgrenier
Site Admin
Posts: 3330
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Deleted files using rm -rf /

#2 Post by cgrenier » 25 Mar 2012, 09:42

Try TestDisk, Advanced, Undelete but usually it only works for ext2.
If it doesn't work, run PhotoRec 6.14-WIP

Code: Select all

wget -N http://www.cgsecurity.org/testdisk-6.14-WIP.linux26.tar.bz2
tar xjf testdisk-6.14-WIP.linux26.tar.bz2
cd testdisk-6.14-WIP
sudo ./photorec_static
Good luck

Post Reply

Who is online

Users browsing this forum: No registered users and 0 guests