On Mon, May 27, 2002 at 01:04:44PM -0400, Christophe Kalt wrote:
> On May 27, Manu Bouyer wrote:
> | Maybe. Is your /usr at the exact same place as the old one ?
> | If so, datas are still there but inodes have all been zeroed, so recovering
> | the file is a matter of finding the rigth blocks, and in the rigth order.
> 
> the coroner's toolkit should be able to help with this.
> http://www.porcupine.org/forensics/tct.html

pkgsrc/security/tct

Regards,
Alistair