Re: [SLUG] recovering removed files
2009/5/14 Barrie Hall bar...@mypond.net: [snip] I've recovered source code by dd'ing the volume to a file and then fishing for blocks of text. A JPEG would present more of a challenge but if it is contagious on the disk you might get lucky. I almost forgot, there's also a jpeg specific recovery tool aptly named 'recoverjpeg' It's in the Ubuntu Universe repository, so it should be fairly straight forward to try... cheers, Owen. -- SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/ Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
Re: [SLUG] recovering removed files
Hi David, I dablled in this once before. I would recomend you go for a Live CD, although you don't need (as the disk isn't monted for system use. I think you'll find that as they tend to prepackaged for this kind of thing, they might just be easier to use. Also saves stuffing around with non-repository software, which is touch and go if your not a developer. I can't remember which it was but I used either: System Rescue CD The Ultimate Boot disk My copies were/are a few years old now, but one of the two i found was able to resurect scarily large amounts of supposedly deleted files. I think that is/was their actual names. Both free, both based on a combination of linux, free BSD and FreeDOS. Good Luck! Jon On Thu, 14 May 2009 12:14:57 pm david wrote: Long story, but I have a photo that has been removed (rm file.jpg) on an ext3 filesystem, Ubuntu 8.10 The hard drive is NOT the root drive and it has been unmounted and remounted read only - # mount -t ext3 -o ro /dev/sdb1 /mountpoint. Nothing was written on the drive as far as I know before unmounting. The obvious question: how to attempt recovery? I've stumbled on a thing called ext3undel but it's not in the Ubuntu repositories, which made me suspicious. There are lots of google comments saying can't be done. What are my chances? any suggestions? Would be nice to have some success stories before I try the wrong thing and mess things up. thanks David. -- SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/ Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
Re: [SLUG] recovering removed files
Thanks for the suggestion for photorec, which in Ubuntu at least is part of the testdisk package. It worked a treat and recovered some very interesting pics and other files. Hmm. A cautionary tale. I couldn't find the all important missing photo, but that led me to the discovery that each drive has it's own seperate .Trash-* folder that doesn't show up in the Gnome tool bar, and the missing files were in there all the time! I'm sure I was supposed to know that, but I thought I'd put that little tip in the archive for others like me who don't know. d'uh. -- SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/ Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
Re: [SLUG] recovering removed files
2009/5/14 david da...@kenpro.com.au: Long story, but I have a photo that has been removed (rm file.jpg) on an ext3 filesystem, Ubuntu 8.10 The hard drive is NOT the root drive and it has been unmounted and remounted read only - # mount -t ext3 -o ro /dev/sdb1 /mountpoint. Nothing was written on the drive as far as I know before unmounting. The obvious question: how to attempt recovery? I've stumbled on a thing called ext3undel but it's not in the Ubuntu repositories, which made me suspicious. There are lots of google comments saying can't be done. What are my chances? any suggestions? Would be nice to have some success stories before I try the wrong thing and mess things up. I have had success in the past using autopsy/sleuthkit (http://www.sleuthkit.org) There's a slight learning curve, but it should be able to do what you ask if the data still exists. cheers, Owen. -- SLUG - Sydney Linux User's Group Mailing List - http://slug.org.au/ Subscription info and FAQs: http://slug.org.au/faq/mailinglists.html
