Re: [gentoo-user] undelete files and dirs on ext3 partition
On Fri, 15 Feb 2008 10:09:37 +0100, pat wrote: One of my coligues used this rm -rf / command on his ext3 partition as root ... of course :-( He removes about 50% of data. And my question is: is there a utility to undelete the files and directories or at least some files? I know that this shouldn't be possible but data are worth to ask :-) He could try photorec from the testdisk package, but mount the filesystem ro immediately to reduce any further damage. The output from photorec isn't pretty and will take a lot of work to sort out what is worth keeping, but that is all part of the learning process :P -- Neil Bothwick Bother, said Pooh, as Satan laid his soul to waste. signature.asc Description: PGP signature
Re: [gentoo-user] undelete files and dirs on ext3 partition
On Friday 15 February 2008, Neil Bothwick wrote: On Fri, 15 Feb 2008 10:09:37 +0100, pat wrote: One of my coligues used this rm -rf / command on his ext3 partition as root ... of course :-( He removes about 50% of data. And my question is: is there a utility to undelete the files and directories or at least some files? I know that this shouldn't be possible but data are worth to ask :-) He could try photorec from the testdisk package, but mount the filesystem ro immediately to reduce any further damage. The output from photorec isn't pretty and will take a lot of work to sort out what is worth keeping, but that is all part of the learning process :P Neil, you are a master of understatement :-) pat, it might be possible to get some stuff back, IF he remounted ro immediately and IF not much writing to the disk happened in the meantime. However, by the time you are done it is usually not worth the effort it took. It's easier to reinstall and restore backups. But if there are some irreplaceable files on that disk, you have no choice. good luck to him. -- Alan McKinnon alan dot mckinnon at gmail dot com -- gentoo-user@lists.gentoo.org mailing list
Re: [gentoo-user] undelete files and dirs on ext3 partition
On Fri, 15 Feb 2008 11:41:28 +0200, Alan McKinnon wrote On Friday 15 February 2008, Neil Bothwick wrote: On Fri, 15 Feb 2008 10:09:37 +0100, pat wrote: One of my coligues used this rm -rf / command on his ext3 partition as root ... of course :-( He removes about 50% of data. And my question is: is there a utility to undelete the files and directories or at least some files? I know that this shouldn't be possible but data are worth to ask :-) He could try photorec from the testdisk package, but mount the filesystem ro immediately to reduce any further damage. The output from photorec isn't pretty and will take a lot of work to sort out what is worth keeping, but that is all part of the learning process :P Neil, you are a master of understatement :-) pat, it might be possible to get some stuff back, IF he remounted ro immediately and IF not much writing to the disk happened in the meantime. However, by the time you are done it is usually not worth the effort it took. It's easier to reinstall and restore backups. But if there are some irreplaceable files on that disk, you have no choice. good luck to him. There's a home directory ... . Pat -- gentoo-user@lists.gentoo.org mailing list
Re: [gentoo-user] undelete files and dirs on ext3 partition
On Friday 15 February 2008, pat wrote: However, by the time you are done it is usually not worth the effort it took. It's easier to reinstall and restore backups. But if there are some irreplaceable files on that disk, you have no choice. good luck to him. There's a home directory ... . With luck, there's a backup too! -- Alan McKinnon alan dot mckinnon at gmail dot com -- gentoo-user@lists.gentoo.org mailing list
Re: [gentoo-user] undelete files and dirs on ext3 partition
On Friday 15 February 2008, pat wrote: On Fri, 15 Feb 2008 11:41:28 +0200, Alan McKinnon wrote Neil, you are a master of understatement :-) pat, it might be possible to get some stuff back, IF he remounted ro immediately and IF not much writing to the disk happened in the meantime. However, by the time you are done it is usually not worth the effort it took. It's easier to reinstall and restore backups. But if there are some irreplaceable files on that disk, you have no choice. good luck to him. There's a home directory ... . What do you mean, Pat? /home still exists and is populated? Then the solution is easy. Back it up immediately. Re-install your whole system and restore /home. Uwe -- Informal Linux Group Namibia: http://www.linux.org.na/ SysEx (Pty) Ltd.: http://www.SysEx.com.na/ -- gentoo-user@lists.gentoo.org mailing list
Re: [gentoo-user] undelete files and dirs on ext3 partition
080215 pat wrote: One of my coligues used this rm -rf / command on his ext3 partition as root: He removes about 50% of data. is there a utility to undelete the files and directories or at least some files? One of the Linux news sites relayed an article yesterday, which mentioned several recovery apps, which are all in Gentoo : magicrescue gpart sleuthkit foremost . -- ,, SUPPORT ___//___, Philip Webb : [EMAIL PROTECTED] ELECTRIC /] [] [] [] [] []| Centre for Urban Community Studies TRANSIT`-O--O---' University of Toronto -- gentoo-user@lists.gentoo.org mailing list
Re: [gentoo-user] undelete files and dirs on ext3 partition
Uwe Thiem writes: On Friday 15 February 2008, pat wrote: On Fri, 15 Feb 2008 11:41:28 +0200, Alan McKinnon wrote Neil, you are a master of understatement :-) pat, it might be possible to get some stuff back, IF he remounted ro immediately and IF not much writing to the disk happened in the meantime. However, by the time you are done it is usually not worth the effort it took. It's easier to reinstall and restore backups. But if there are some irreplaceable files on that disk, you have no choice. good luck to him. There's a home directory ... . What do you mean, Pat? /home still exists and is populated? I think he means there _was_ a /home directory. I'd mout ro, and backup all files that are still there. photorec will find lots of files, but only as single files, without the directory structure. See http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec for a list of supported file types. There are undelete tools for ext2, but I heard they should not work with ext3, because it zeros out things instead of just marking them as deleted as it was in ext2. However, I also heard that someone had success with midnight commander, which has an undelete feature (F9, Commands menu). I did not try it, but this tool sounds promising: http://freshmeat.net/projects/giis giis (gET iT i sAY) is a file recovery tool for Ext2/Ext3 filesystems. Once installed, current files and newly created files can be recovered. It allows users to recover all deleted files, recover files owned by a specific user, dump data from old file locations, and recover files of a specific type, such as text or PNG. A forensic analyzer is also provided to assist users during recovery. Good luck, Wonko
Re: [gentoo-user] undelete files and dirs on ext3 partition
On Fri, 15 Feb 2008 12:01:25 +0100, Alex Schuster wrote Uwe Thiem writes: On Friday 15 February 2008, pat wrote: On Fri, 15 Feb 2008 11:41:28 +0200, Alan McKinnon wrote Neil, you are a master of understatement :-) pat, it might be possible to get some stuff back, IF he remounted ro immediately and IF not much writing to the disk happened in the meantime. However, by the time you are done it is usually not worth the effort it took. It's easier to reinstall and restore backups. But if there are some irreplaceable files on that disk, you have no choice. good luck to him. There's a home directory ... . What do you mean, Pat? /home still exists and is populated? I think he means there _was_ a /home directory. I'd mout ro, and backup all files that are still there. photorec will find lots of files, but only as single files, without the directory structure. See http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec for a list of supported file types. There are undelete tools for ext2, but I heard they should not work with ext3, because it zeros out things instead of just marking them as deleted as it was in ext2. However, I also heard that someone had success with midnight commander, which has an undelete feature (F9, Commands menu). I did not try it, but this tool sounds promising: http://freshmeat.net/projects/giis giis (gET iT i sAY) is a file recovery tool for Ext2/Ext3 filesystems. Once installed, current files and newly created files can be recovered. It allows users to recover all deleted files, recover files owned by a specific user, dump data from old file locations, and recover files of a specific type, such as text or PNG. A forensic analyzer is also provided to assist users during recovery. Yes, there was the home directory. Thanks to all for the help. Pat
