I think it would depend on what the physical medium is. If it's on a mainframe DASD volume, it should be shadowed and DFH should be able to recover it. If it's on a HD, some of the 'low level' formatting programs should be able to look at the physical drive to recover it. On IDE/ATAPI drives, an erasure usually only deletes the directory and the blocks are untouched. Hope this helps, but it sounds like you may have been 'attacked'.....successfully.
D Waldo Anderson -----Original Message----- From: Linux on 390 Port [mailto:[EMAIL PROTECTED] On Behalf Of van Sleeuwen, Berry Sent: Thursday, November 27, 2008 7:11 AM To: LINUX-390@VM.MARIST.EDU Subject: Recover a root disk Hello list, Last night we had to recover the root disk of one of our SLES9 machines. For some unknown reason part of the root disk has disappeared. In the end we have restored the disk from our backups but we still have no idea why this had happend. It looks like someone has removed selected files or directories. Some directories are stil available, such as /bin or /boot but other have been partially or entirly removed. /etc contains some 40 files, var/log is gone, /var/spool still exists. Would it be possible to recover the data from the disk? Are there any tools available that can analyze and/or recover files? For instance the /var/log has vanished so if we could recover that perhaps it would give us some clue as to what happend. Do you have any thoughts as to why a part of a filesystem can just disappear? With kind regards, Berry van Sleeuwen. ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390
