[gentoo-user] undelete files and dirs on ext3 partition

[gentoo-user] undelete files and dirs on ext3 partition

[pat]

Hello,

One of my coligues used this "rm -rf /" command on his ext3 partition as root
... of course :-( He removes about 50% of data. And my question is: is there a
utility to undelete the files and directories or at least some files? I know
that this shouldn't be possible but data are worth to ask :-)

Thanks a lot.

     Pat
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] undelete files and dirs on ext3 partition

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 716 bytes --]

On Fri, 15 Feb 2008 10:09:37 +0100, pat wrote:

> One of my coligues used this "rm -rf /" command on his ext3 partition
> as root ... of course :-( He removes about 50% of data. And my question
> is: is there a utility to undelete the files and directories or at
> least some files? I know that this shouldn't be possible but data are
> worth to ask :-)

He could try photorec from the testdisk package, but mount the filesystem
ro immediately to reduce any further damage. The output from photorec
isn't pretty and will take a lot of work to sort out what is worth
keeping, but that is all part of the learning process :P


-- 
Neil Bothwick

"Bother," said Pooh, as Satan laid his soul to waste.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-user] undelete files and dirs on ext3 partition

[Alan McKinnon]

On Friday 15 February 2008, Neil Bothwick wrote:
> On Fri, 15 Feb 2008 10:09:37 +0100, pat wrote:
> > One of my coligues used this "rm -rf /" command on his ext3
> > partition as root ... of course :-( He removes about 50% of data.
> > And my question is: is there a utility to undelete the files and
> > directories or at least some files? I know that this shouldn't be
> > possible but data are worth to ask :-)
>
> He could try photorec from the testdisk package, but mount the
> filesystem ro immediately to reduce any further damage. The output
> from photorec isn't pretty and will take a lot of work to sort out
> what is worth keeping, but that is all part of the learning process
> :P

Neil, you are a master of understatement :-)

pat, it might be possible to get some stuff back, IF he remounted ro 
immediately and IF not much writing to the disk happened in the 
meantime.

However, by the time you are done it is usually not worth the effort it 
took. It's easier to reinstall and restore backups. But if there are 
some irreplaceable files on that disk, you have no choice. good luck to 
him.


-- 
Alan McKinnon
alan dot mckinnon at gmail dot com

-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] undelete files and dirs on ext3 partition

[pat]

On Fri, 15 Feb 2008 11:41:28 +0200, Alan McKinnon wrote
> On Friday 15 February 2008, Neil Bothwick wrote:
> > On Fri, 15 Feb 2008 10:09:37 +0100, pat wrote:
> > > One of my coligues used this "rm -rf /" command on his ext3
> > > partition as root ... of course :-( He removes about 50% of data.
> > > And my question is: is there a utility to undelete the files and
> > > directories or at least some files? I know that this shouldn't be
> > > possible but data are worth to ask :-)
> >
> > He could try photorec from the testdisk package, but mount the
> > filesystem ro immediately to reduce any further damage. The output
> > from photorec isn't pretty and will take a lot of work to sort out
> > what is worth keeping, but that is all part of the learning process
> > :P
> 
> Neil, you are a master of understatement :-)
> 
> pat, it might be possible to get some stuff back, IF he remounted ro 
> immediately and IF not much writing to the disk happened in the 
> meantime.
> 
> However, by the time you are done it is usually not worth the effort 
> it took. It's easier to reinstall and restore backups. But if there 
> are some irreplaceable files on that disk, you have no choice. good 
> luck to him.
> 

There's a home directory ... .

     Pat
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] undelete files and dirs on ext3 partition

[Uwe Thiem]

On Friday 15 February 2008, pat wrote:
> On Fri, 15 Feb 2008 11:41:28 +0200, Alan McKinnon wrote

> > Neil, you are a master of understatement :-)
> >
> > pat, it might be possible to get some stuff back, IF he remounted
> > ro immediately and IF not much writing to the disk happened in
> > the meantime.
> >
> > However, by the time you are done it is usually not worth the
> > effort it took. It's easier to reinstall and restore backups. But
> > if there are some irreplaceable files on that disk, you have no
> > choice. good luck to him.
>
> There's a home directory ... .

What do you mean, Pat? /home still exists and is populated? Then the 
solution is easy. Back it up immediately. Re-install your whole 
system and restore /home. 

Uwe

-- 
Informal Linux Group Namibia:
http://www.linux.org.na/
SysEx (Pty) Ltd.:
http://www.SysEx.com.na/
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] undelete files and dirs on ext3 partition

[Alan McKinnon]

On Friday 15 February 2008, pat wrote:
> > However, by the time you are done it is usually not worth the
> > effort it took. It's easier to reinstall and restore backups. But
> > if there are some irreplaceable files on that disk, you have no
> > choice. good luck to him.
>
> There's a home directory ... .

With luck, there's a backup too!

-- 
Alan McKinnon
alan dot mckinnon at gmail dot com

-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] undelete files and dirs on ext3 partition

[Philip Webb]

080215 pat wrote:
> One of my coligues used this "rm -rf /" command on his ext3 partition
> as root: He removes about 50% of data.  is there a utility
> to undelete the files and directories or at least some files?

One of the Linux news sites relayed an article yesterday,
which mentioned several recovery apps, which are all in Gentoo :
  magicrescue  gpart  sleuthkit  foremost .

-- 
========================,,============================================
SUPPORT     ___________//___,  Philip Webb : purslow@chass.utoronto.ca
ELECTRIC   /] [] [] [] [] []|  Centre for Urban & Community Studies
TRANSIT    `-O----------O---'  University of Toronto
-- 
gentoo-user@lists.gentoo.org mailing list

Re: [gentoo-user] undelete files and dirs on ext3 partition

[Alex Schuster]

[-- Attachment #1: Type: text/plain, Size: 1789 bytes --]

Uwe Thiem writes:

> On Friday 15 February 2008, pat wrote:
> > On Fri, 15 Feb 2008 11:41:28 +0200, Alan McKinnon wrote
> >
> > > Neil, you are a master of understatement :-)
> > >
> > > pat, it might be possible to get some stuff back, IF he remounted
> > > ro immediately and IF not much writing to the disk happened in
> > > the meantime.
> > >
> > > However, by the time you are done it is usually not worth the
> > > effort it took. It's easier to reinstall and restore backups. But
> > > if there are some irreplaceable files on that disk, you have no
> > > choice. good luck to him.
> >
> > There's a home directory ... .
>
> What do you mean, Pat? /home still exists and is populated? 

I think he means there _was_ a /home directory.

I'd mout ro, and backup all files that are still there. photorec will find lots of files, but only as single files, without the directory structure. See <http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec> for a list of supported file types.

There are undelete tools for ext2, but I heard they should not work with ext3, because it zeros out things instead of just marking them as deleted as it was in ext2. However, I also heard that someone had success with midnight commander, which has an undelete feature (F9, Commands menu).

I did not try it, but this tool sounds promising:
http://freshmeat.net/projects/giis

giis (gET iT i sAY) is a file recovery tool for Ext2/Ext3 filesystems. Once installed, current files and newly created files can be recovered. It allows users to recover all deleted files, recover files owned by a specific user, dump data from old file locations, and recover files of a specific type, such as text or PNG. A forensic analyzer is also provided to assist users during recovery.

Good luck,
	Wonko

[-- Attachment #2: Type: text/html, Size: 2286 bytes --]

Re: [gentoo-user] undelete files and dirs on ext3 partition

[pat]

[-- Attachment #1: Type: text/plain, Size: 1967 bytes --]

On Fri, 15 Feb 2008 12:01:25 +0100, Alex Schuster wrote
> Uwe Thiem writes:
> 
> > On Friday 15 February 2008, pat wrote:
> > > On Fri, 15 Feb 2008 11:41:28 +0200, Alan McKinnon wrote
> > >
> > > > Neil, you are a master of understatement :-)
> > > >
> > > > pat, it might be possible to get some stuff back, IF he remounted
> > > > ro immediately and IF not much writing to the disk happened in
> > > > the meantime.
> > > >
> > > > However, by the time you are done it is usually not worth the
> > > > effort it took. It's easier to reinstall and restore backups. But
> > > > if there are some irreplaceable files on that disk, you have no
> > > > choice. good luck to him.
> > >
> > > There's a home directory ... .
> >
> > What do you mean, Pat? /home still exists and is populated? 
> 
> I think he means there _was_ a /home directory.
> 
> I'd mout ro, and backup all files that are still there. photorec will find lots of files, but only as single files, without the directory structure. See <http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec> for a list of supported file types.
> 
> There are undelete tools for ext2, but I heard they should not work with ext3, because it zeros out things instead of just marking them as deleted as it was in ext2. However, I also heard that someone had success with midnight commander, which has an undelete feature (F9, Commands menu).
> 
> I did not try it, but this tool sounds promising:
> http://freshmeat.net/projects/giis
> 
> giis (gET iT i sAY) is a file recovery tool for Ext2/Ext3 filesystems. Once installed, current files and newly created files can be recovered. It allows users to recover all deleted files, recover files owned by a specific user, dump data from old file locations, and recover files of a specific type, such as text or PNG. A forensic analyzer is also provided to assist users during recovery.
>

Yes, there was the home directory.

Thanks to all for the help.

     Pat

 

[-- Attachment #2: Type: text/html, Size: 2816 bytes --]