On Thu, Aug 19, 2010 at 09:07:51PM +0300, EforeZZ wrote: > I edited my 50Kb /etc/rc.conf, loaded a driver and.... got a kernel panic!! > After reboot my /etc/rc.conf is 0 bytes (after automatic background fsck). > Which tool should I try now to restore any version of my rc.conf?..
The programs from sysutils/sleuthkit might help. > I think data should still be somewhere on the disk.... That depends on if the partition where /etc/rc.conf is located is read/write or read-only. In the latter case you are correct. In the former case part or all of the sectors could have been re-used for other files. For the best chance at recovery, make your root partition read-only _now_. For future reference; you should never edit files in /etc/ directly. If you want ot edit files in /etc or /usr/local/etc, first copy them to a directory in your $HOME, put them under revision control and then edit them and copy the edited files to /etc. That way you always have a backup and you can even restore previous versions. I've documented the procedure I use on my webpage; http://www.xs4all.nl/~rsmith/unix/configfiles.html Roland -- R.F.Smith http://www.xs4all.nl/~rsmith/ [plain text _non-HTML_ PGP/GnuPG encrypted/signed email much appreciated] pgp: 1A2B 477F 9970 BA3C 2914 B7CE 1277 EFB0 C321 A725 (KeyID: C321A725)
pgplleqOlNAub.pgp
Description: PGP signature