Re: Emergence: recover deleted files
Thanks for anyone's help: part of the deleted files was rescued. Today I'm fetching a new hard disk on which to continue the search, because I have many partitions on the present hard disk ando so there isn't enough space left in each of them to store all the files found by photorec. On Mon, 06 Sep 2010, Rodolfo Medina wrote: Excuse so many questions, but the issue is a major one. Eduardo M KALINOWSKI edua...@kalinowski.com.br writes: If it's major, why so much resistance in following the advice that has been given? Beacuse: I'm in hda6, the partition containing the deletes files. When I reboot into a live CD or into another partition of the hard disk, say hda8, as far as I know - but maybe I'm wrong - during the reboot the system will write reports in some files of hda6, which we don't want to. Instead, if I do: `# cd /mnt/hda8', and run photorec from hda8, we avoid the possible damage caused by the reboot or the shutdown, and also we don't touch hda6. Is that true? I'll have to shut down though to mount a new hard disk. Rodolfo -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/877hix6c55@gmail.com
Re: Emergence: recover deleted files
Eduardo M KALINOWSKI wrote at 2010-09-06 06:59 -0500: On Mon, 06 Sep 2010, Rodolfo Medina wrote: ...And: suppose I had only partition hda6 on the hard disk: even using a live CD, as suggested by other listers, where could recovered file have been stored, since we don't want to write on hda6? You'd have to get another place to store the files - another disk, a pendrive, etc. Or if all the files will fit in memory, use tmpfs and write back to the disk when recovery is finished. signature.asc Description: Digital signature
Re: Emergence: recover deleted files
Rodolfo Medina wrote at 2010-09-05 22:21 -0500: To do as you suggest, I have to log out hda6 and reboot into hda8, otherwise mount won't umount hda6 because it's busy. Won't the reboot worse the damage? The system is probably writing logs to the disk. But I don't know what your partition scheme looks like. You could send the output of mount maybe. signature.asc Description: Digital signature
Re: Emergence: recover deleted files
Rodolfo Medina wrote at 2010-09-07 06:12 -0500: Eduardo M KALINOWSKI edua...@kalinowski.com.br writes: If it's major, why so much resistance in following the advice that has been given? Beacuse: I'm in hda6, the partition containing the deletes files. When I reboot into a live CD or into another partition of the hard disk, say hda8, as far as I know - but maybe I'm wrong - during the reboot the system will write reports in some files of hda6, which we don't want to. Instead, if I do: `# cd /mnt/hda8', and run photorec from hda8, we avoid the possible damage caused by the reboot or the shutdown, and also we don't touch hda6. Is that true? These 4 options have been mentioned: 1. remount hda6 readonly 2. umount hda6 3. reboot to LiveCD 4. immediate power-off (pull the plug) If 1 and 2 are not possible (on 2 you could try forcing it, see umount(8)), and 4 could possibly cause filesystem damage, then 3 is your only remaining option. The writes that have occured to hda6 while the system runs are probably more than what will occur when you shutdown the system. signature.asc Description: Digital signature
Re: Emergence: recover deleted files
On 09/07/2010 08:12 AM, Rodolfo Medina wrote: When I reboot into a live CD or into another partition of the hard disk, say hda8, as far as I know - but maybe I'm wrong - during the reboot the system will write reports in some files of hda6, which we don't want to. Booting a live CD should not write anything to any disk. It's true that there are dozens of live CDs out there, but I see no reason why they should mess with your disks unless you tell them to. I believe most won't even mount partitions in hard disks automatically. Instead, if I do: `# cd /mnt/hda8', and run photorec from hda8, we avoid the possible damage caused by the reboot or the shutdown, and also we don't touch hda6. Is that true? Again, where you run the program is essentially irrelevant - what matters is where files are written to. If the program writes to the current directory, then you must cd elsewhere, but if not, you could run from a directory in hda6 and just tell it to store files under /mnt/hda8. However, probably the program will refuse to work on a mounted filesystem anyway. By the way, it's late now, but did you try googling something like how to use photorec? I found some quite detailed guides. -- Your lover will never wish to leave you. Eduardo M KALINOWSKI edua...@kalinowski.com.br -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/4c863f9d.7050...@kalinowski.com.br
Re: Emergence: recover deleted files
Rodolfo Medina wrote at 2010-09-07 06:12 -0500: I'm in hda6, the partition containing the deletes files. When I reboot into a live CD or into another partition of the hard disk, say hda8, as far as I know - but maybe I'm wrong - during the reboot the system will write reports in some files of hda6, which we don't want to. Instead, if I do: `# cd /mnt/hda8', and run photorec from hda8, we avoid the possible damage caused by the reboot or the shutdown, and also we don't touch hda6. Is that true? green greenfreedo...@gmail.com writes: These 4 options have been mentioned: 1. remount hda6 readonly 2. umount hda6 3. reboot to LiveCD 4. immediate power-off (pull the plug) The fifth: tell photorec to perform the writings into hda8. If I understand well, you think that even so hda6 would also be written: how? Rodolfo -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/87zkvt3bs6@gmail.com
Re: Emergence: recover deleted files
On 09/07/2010 08:12 AM, Rodolfo Medina wrote: if I do: `# cd /mnt/hda8', and run photorec from hda8, we avoid the possible damage caused by the reboot or the shutdown, and also we don't touch hda6. Is that true? Eduardo M KALINOWSKI edua...@kalinowski.com.br writes: Again, where you run the program is essentially irrelevant - what matters is where files are written to. If the program writes to the current directory, then you must cd elsewhere, but if not, you could run from a directory in hda6 and just tell it to store files under /mnt/hda8. If so, then why to run a live CD? Isn't it much more simple doing as above? By the way, it's late now, but did you try googling something like how to use photorec? I found some quite detailed guides. I followed this: http://groups.google.com/group/linux.debian.user/topic Bye Rodolfo -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/87sk1lvegi@gmail.com
Re: Emergence: recover deleted files
On 09/07/2010 11:02 AM, Rodolfo Medina wrote: Eduardo M KALINOWSKI edua...@kalinowski.com.br writes: Again, where you run the program is essentially irrelevant - what matters is where files are written to. If the program writes to the current directory, then you must cd elsewhere, but if not, you could run from a directory in hda6 and just tell it to store files under /mnt/hda8. If so, then why to run a live CD? Isn't it much more simple doing as above? It's simpler (and subjectively seems safer), especially for newbies. It's also more general: if the partition from where files were deleted contains only /home or other non-essential directories, it is possible to run recovery from the running system (the partition only needs to be unmounted), but if the partitions holds /, /var, etc, then it is hard (or impossible) to unmount (or even mount read-only) the partition, and some external system is necessary. -- memo, n.: An interoffice communication too often written more for the benefit of the person who sends it than the person who receives it. Eduardo M KALINOWSKI edua...@kalinowski.com.br -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/4c8653c0.1060...@kalinowski.com.br
Re: Emergence: recover deleted files
Rodolfo Medina wrote at 2010-09-07 08:48 -0500: green greenfreedo...@gmail.com writes: These 4 options have been mentioned: 1. remount hda6 readonly 2. umount hda6 3. reboot to LiveCD 4. immediate power-off (pull the plug) The fifth: tell photorec to perform the writings into hda8. If I understand well, you think that even so hda6 would also be written: how? You did not send the output of the mount command. However, it seems that hda6 is the root partition for the running system. If so, the running system is writing to the filesystem as we discuss this again and again. Do what you want. signature.asc Description: Digital signature
Re: Emergence: recover deleted files
Hey, Rodolfo Medina wrote at 2010-09-05 16:54 -0500: To avoid that risk, would it be all right, from within hda6, just cd to hda8 and there perform writes? Is the machine in question still booted and running with hda6 as /home? I would shutdown, use a liveCD, mount hda6 as ro, and hda8 as rw and do it from there. But if you cant do that, then I suppose it should be ok. I dont *think* shutting down will cause any problems, but I am not 100% sure. Excuse so many questions, but the issue is a major one. Thanks Rodolfo -- Regards, Angus Hedger Debian GNU/Linux User PGP Public Key 0xEE6A4B97 signature.asc Description: PGP signature
Re: Emergence: recover deleted files
On Mon, 06 Sep 2010, Rodolfo Medina wrote: ...And: suppose I had only partition hda6 on the hard disk: even using a live CD, as suggested by other listers, where could recovered file have been stored, since we don't want to write on hda6? You'd have to get another place to store the files - another disk, a pendrive, etc. -- Boys are beyond the range of anybody's sure understanding, at least when they are between the ages of 18 months and 90 years. -- James Thurber Eduardo M KALINOWSKI edua...@kalinowski.com.br -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20100906085909.43972aqq1am37...@mail.kalinowski.com.br
Re: Emergence: recover deleted files
On Mon, 06 Sep 2010, Rodolfo Medina wrote: To avoid that risk, would it be all right, from within hda6, just cd to hda8 and there perform writes? It doesn't really matter from where you run the program, only where it writes to. And you must only write to another disk. That said, it is better if you unmount the partition with deleted files, or at least remount it read-only. If it is busy, stop the processes that have open files in it (see lsof and fuser programs). While it may cause writes to the system, it's better that simply pull the power cord and risk file system corruption. And if programs are running, they might be writing files. If it's the root partition, you'll need to reboot in another system, either from a CD (easiest way) or another system in your HD, if you have one. Excuse so many questions, but the issue is a major one. If it's major, why so much resistance in following the advice that has been given? First, it seems you haven't yet unmounted the partition where files were deleted, even after some 24 hours of the problem. That should have been the first thing to do. The easiest way to do that is turn off the system. (While not strictly necessary - the important bit is to unmount the partition with deleted files, since you'll be doing a reboot, it doesn't matter.) Download and burn a live CD, if necessary using another computer. If it already has the recovery program, it is easier, if not, select one that allows installing new packages from the live system (Ubuntu does, packages go in RAM filesystem.) Run the recovery program from the live CD on the partition. It may be that the program requires the partition to be unmounted, if not, and you must mount it, mount it as read-only. Let it run, and store the results somewhere else - another partition, another drive, pen drive, in another computer (via network, etc.) -- Don't know what time I'll be back, Mom. Probably soon after she throws me out. Eduardo M KALINOWSKI edua...@kalinowski.com.br -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20100906091114.16674dy8w545a...@mail.kalinowski.com.br
Emergence: recover deleted files
By mistake, I deleted most files from my sister's home directory via rysnc and ethernet cable. Please suggest any way to possibly recover at least some of them. Thanks for any help Rodolfo -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/87bp8czcga@gmail.com
Re: Emergence: recover deleted files
On Sun, Sep 05, 2010 at 12:55:49PM +0200, Rodolfo Medina wrote: By mistake, I deleted most files from my sister's home directory via rysnc and ethernet cable. Please suggest any way to possibly recover at least some of them. Try photorec. Search the archives for /home/user folder accedentally removed. It was just a couple days ago. -Rob -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20100905112053.ga25...@aurora.owens.net
Re: Emergence: recover deleted files
Rob Owens row...@ptd.net writes: On Sun, Sep 05, 2010 at 12:55:49PM +0200, Rodolfo Medina wrote: By mistake, I deleted most files from my sister's home directory via rysnc and ethernet cable. Please suggest any way to possibly recover at least some of them. Try photorec. Search the archives for /home/user folder accedentally removed. It was just a couple days ago. How can I copy the program in the damaged directory without permenently overwriting the deleted files? Rodolfo -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/87k4n0xrzz@gmail.com
Re: Emergence: recover deleted files
On Sunday 05 September 2010 14:02:56 Rodolfo Medina wrote: Rob Owens row...@ptd.net writes: On Sun, Sep 05, 2010 at 12:55:49PM +0200, Rodolfo Medina wrote: By mistake, I deleted most files from my sister's home directory via rysnc and ethernet cable. Please suggest any way to possibly recover at least some of them. Try photorec. Search the archives for /home/user folder accedentally removed. It was just a couple days ago. How can I copy the program in the damaged directory without permenently overwriting the deleted files? Did you find the thread? It gives full instructions. Lisi -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/201009051420.10526.lisi.re...@gmail.com
Re: Emergence: recover deleted files
On 09/05/2010 10:02 AM, Rodolfo Medina wrote: How can I copy the program in the damaged directory without permenently overwriting the deleted files? Don't try. You must run any recovery program from another disk. Only this way you maximize the chances of recovery. By the way, the easiest way to recover is to restore the files from the backups you certainly made before. ;-) -- Eduardo M KALINOWSKI edua...@kalinowski.com.br -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/4c8395d2.2040...@kalinowski.com.br
Re: Emergence: recover deleted files
Rodolfo Medina wrote at 2010-09-05 05:55 -0500: By mistake, I deleted most files from my sister's home directory via rysnc and ethernet cable. Please suggest any way to possibly recover at least some of them. First, make sure you do not make any writes to the filesystem which contains /home. Then proceed with recovery attempts. signature.asc Description: Digital signature
Re: Emergence: recover deleted files
Hey, On Sun, 05 Sep 2010 12:55:49 +0200 Rodolfo Medina rodolfo.med...@gmail.com wrote: By mistake, I deleted most files from my sister's home directory via rysnc and ethernet cable. Please suggest any way to possibly recover at least some of them. I would pull the drive out of the system and put it in your machine (if doable, eg its not a laptop) and use photorec [1] to recover what you can. If you cant, use a livecd for example sysresccd [2] (can be used from a CD or USB stick) and use photorec from that. Filenames etc will not be the same, but you should get back most of it if you haven’t written anything to the drive. Note: Dont try to recover to the same partition as the one with the data on it which you are trying to get back! I have been able to recover just about everything when i messed up a partition table on a drive, some files where corrupted, but most survived, the biggest problem was that the names where not intact, though that might depends on the filesystem you are recovering from, ymmv! Thanks for any help Rodolfo Your welcome, Good luck! [1] http://www.cgsecurity.org/wiki/PhotoRec (should also be in the repo) [2] http://www.sysresccd.org/Main_Page -- Regards, Angus Hedger Debian GNU/Linux User PGP Public Key 0xEE6A4B97 signature.asc Description: PGP signature
Re: Emergence: recover deleted files
Rodolfo Medina wrote at 2010-09-05 05:55 -0500: By mistake, I deleted most files from my sister's home directory via rysnc and ethernet cable. Please suggest any way to possibly recover at least some of them. green greenfreedo...@gmail.com writes: First, make sure you do not make any writes to the filesystem which contains /home. Then proceed with recovery attempts. Angus Hedger demide...@gmail.com writes: I would pull the drive out of the system and put it in your machine (if doable, eg its not a laptop) and use photorec [1] to recover what you can. If you cant, use a livecd for example sysresccd [2] (can be used from a CD or USB stick) and use photorec from that. The deleted files are from partition hda6: is it all right if I run photorec from partition hda8 and store there the recovered files, _without_ performing _any_ writes in hda6? Thanks! Rodolfo -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/87r5h75015@gmail.com
Re: Emergence: recover deleted files
Hey, On Sun, 05 Sep 2010 23:54:30 +0200 Rodolfo Medina rodolfo.med...@gmail.com wrote: Rodolfo Medina wrote at 2010-09-05 05:55 -0500: The deleted files are from partition hda6: is it all right if I run photorec from partition hda8 and store there the recovered files, _without_ performing _any_ writes in hda6? Yup! Thanks! Rodolfo Good luck! -- Regards, Angus Hedger Debian GNU/Linux User PGP Public Key 0xEE6A4B97 signature.asc Description: PGP signature
Re: Emergence: recover deleted files
Rodolfo Medina wrote at 2010-09-05 16:54 -0500: The deleted files are from partition hda6: is it all right if I run photorec from partition hda8 and store there the recovered files, _without_ performing _any_ writes in hda6? You can ensure that no writes are made on hda6 by running the mount command and checking the filesystem mount options. You should see 'ro' inside parentheses rather than 'rw'. To switch from rw to ro, you can run: # mount -o remount,ro /dev/hda6 You can make that permanent (for the duration of recovery) by editing /etc/fstab. Add 'ro' to the 'options' portion of the applicable line. signature.asc Description: Digital signature
Re: Emergence: recover deleted files
Rodolfo Medina wrote at 2010-09-05 16:54 -0500: The deleted files are from partition hda6: is it all right if I run photorec from partition hda8 and store there the recovered files, _without_ performing _any_ writes in hda6? green greenfreedo...@gmail.com writes: You can ensure that no writes are made on hda6 by running the mount command and checking the filesystem mount options. You should see 'ro' inside parentheses rather than 'rw'. To switch from rw to ro, you can run: # mount -o remount,ro /dev/hda6 You can make that permanent (for the duration of recovery) by editing /etc/fstab. Add 'ro' to the 'options' portion of the applicable line. To do as you suggest, I have to log out hda6 and reboot into hda8, otherwise mount won't umount hda6 because it's busy. Won't the reboot worse the damage? Thanks. Rodolfo -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/871v971rre@gmail.com
Re: Emergence: recover deleted files
Rodolfo Medina wrote at 2010-09-05 16:54 -0500: The deleted files are from partition hda6: is it all right if I run photorec from partition hda8 and store there the recovered files, _without_ performing _any_ writes in hda6? green greenfreedo...@gmail.com writes: You can ensure that no writes are made on hda6 by running the mount command and checking the filesystem mount options. You should see 'ro' inside parentheses rather than 'rw'. To switch from rw to ro, you can run: # mount -o remount,ro /dev/hda6 You can make that permanent (for the duration of recovery) by editing /etc/fstab. Add 'ro' to the 'options' portion of the applicable line. Rodolfo Medina rodolfo.med...@gmail.com writes: To do as you suggest, I have to log out hda6 and reboot into hda8, otherwise mount won't umount hda6 because it's busy. Won't the reboot worse the damage? ...And: suppose I had only partition hda6 on the hard disk: even using a live CD, as suggested by other listers, where could recovered file have been stored, since we don't want to write on hda6? Rodolfo -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/87hbi38qgj@gmail.com
Re: Emergence: recover deleted files
Rodolfo Medina wrote at 2010-09-05 16:54 -0500: The deleted files are from partition hda6: is it all right if I run photorec from partition hda8 and store there the recovered files, _without_ performing _any_ writes in hda6? green greenfreedo...@gmail.com writes: You can ensure that no writes are made on hda6 by running the mount command and checking the filesystem mount options. You should see 'ro' inside parentheses rather than 'rw'. To switch from rw to ro, you can run: # mount -o remount,ro /dev/hda6 You can make that permanent (for the duration of recovery) by editing /etc/fstab. Add 'ro' to the 'options' portion of the applicable line. Rodolfo Medina rodolfo.med...@gmail.com writes: To do as you suggest, I have to log out hda6 and reboot into hda8, otherwise mount won't umount hda6 because it's busy. Won't the reboot worse the damage? To avoid that risk, would it be all right, from within hda6, just cd to hda8 and there perform writes? Excuse so many questions, but the issue is a major one. Thanks Rodolfo -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/87mxrvbi8a@gmail.com
