Help! NIMDA

[Josef Karthauser]

--FEz7ebHBGB6b2e8X
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Sep 20, 2001 at 02:08:29AM +0100, Brian Somers wrote:
> > On Wed, Sep 19, 2001 at 05:56:21PM +0100, Thomas Beauchamp wrote:
> > > Hi!
> > >=3D20
> > > On my FreeBSD  4.2 server, logged as 'root', I type by mistake follow=
ing
> > > command:
> > >=3D20
> > > rm -R / *.eml
> > >=3D20
> > > What is the extent of the damage, please.
> > >=3D20
> > > It looks as if almost everything is erased.
> >=20
> > Whoops.  It's not going to be easy to fix.  Will almost definitely
> > require a reinstall.
> >=20
> > It _may_ be possible to recover some of the data, but I don't know
> > off the top of my head whether there are any tools around for that.
>=20
> Indeed.  This is the electronic equivalent to blowing your foot off=20
> with a sawn-off shotgun and asking if there's any way of walking=20
> again.
>=20
> The answer is yes, but you'll need to get yourself a new foot (or=20
> restore your foot from a backup).

For the benefit of the list, this is what I sent him privately;

Shut the machine down.
Bring up FreeBSD on a new drive.
Plug this drive in on another drive channel, but don't install anything
on it.
=20
Install the following ports on the new machine:
=20
    Port:   ffsrecov-0.5
    Path:   /usr/ports/sysutils/ffsrecov
    Info:   Recover files from a corrupt FFS
    Maint:  ports at FreeBSD.org
    Index:  sysutils
    B-deps:
    R-deps:
=20
    Port:   gpart-0.1h
    Path:   /usr/ports/sysutils/gpart
    Info:   Tries to recover lost partition tables and file systems
    Maint:  andrew at ugh.net.au
    Index:  sysutils
    B-deps: gettext-0.10.35 gmake-3.79.1
    R-deps:
=20
You _may_ find them helpful in recovering the data, although I've got no
experience of them.
=20
Joe

--FEz7ebHBGB6b2e8X
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAjupygIACgkQXVIcjOaxUBYHPwCgoCNlF1A8fA7iaY4bOhKvmi2E
fCQAnjDc1l2OL781PSjT12dT3RMc3jhm
=NNtQ
-----END PGP SIGNATURE-----

--FEz7ebHBGB6b2e8X--