On Thu, 29 Mar 2007 12:25:17 +0000
"Mike M. Volokhov" <mishka@NetBSD.org> wrote:

> Matthias Scheler <tron@zhadum.org.uk> wrote:
> > On Fri, Mar 02, 2007 at 12:23:03AM -0700, Co Thai Ngo wrote:
> [snip]
> > > I'm looking for something like unrm, but couldn't find one.
> > 
> > I'm sorry but I don't think such an utility exists for NetBSD. And
> > even if you had it it would require to stop the box immediately
> > after accidently deleting the files because they might get
> > overwritten otherwise.
> 
> AFAIU files cannot be recovered because most of data from inodes
> is flushed

You may want to look at http://www.porcupine.org/forensics/tct.html and
Chapter 4 of http://www.porcupine.org/forensics/forensic-discovery/

		--Steve Bellovin, http://www.cs.columbia.edu/~smb