Re: ufs recovery
Dear All, It looks like I'm able to recover all of the deleted files. I'm using UFS Explorer Professional Recovery, I'm working on it for more than 30 hours, its a long time but it works! Yaaay! Laci Sent from my mobile. On 2013.09.09., at 0:36, kpn...@pobox.com wrote: On Mon, Sep 09, 2013 at 12:03:52AM +0200, Roland Smith wrote: On Sun, Sep 08, 2013 at 10:46:35AM +0200, Laszlo Danielisz wrote: Hi, By mistake I forgot to edit my crontab on my FreeBSD 8.3 after I took out one of the hard drives. I had a little rsync script which I used to synchronise a directory between those two hard drives, because one of the hard drives were not present anymore and rsync had the --delete parameter I end up deleting the whole directory, of course with precious informations. Ouch. I have a similar procedure going. But I put it in a shell-script that mounts the destination _and_ checks if the destination is properly mounted _before_ starting the rsync. I would suggest you do something similar in the future. Just to be clear, was the information deleted from _both_ harddisks? How about using UFS labels and putting the label device into the fstab instead of the raw block device? Then if the situation happens again the changed block device names will not matter. I believe tunefs -L will do the trick. -- A method for inducing cats to exercise consists of directing a beam of invisible light produced by a hand-held laser apparatus onto the floor ... in the vicinity of the cat, then moving the laser ... in an irregular way fascinating to cats,... -- US patent 5443036, Method of exercising a cat ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: ufs recovery
On Tue, 10 Sep 2013 22:38:46 +0200, Laszlo Danielisz wrote: Dear All, It looks like I'm able to recover all of the deleted files. I'm using UFS Explorer Professional Recovery, I'm working on it for more than 30 hours, its a long time but it works! If recovery works, time does not matter. Success does. :-) -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ... ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: ufs recovery
On 08/09/2013 09:46, Laszlo Danielisz wrote: Hi, By mistake I forgot to edit my crontab on my FreeBSD 8.3 after I took out one of the hard drives. I had a little rsync script which I used to synchronise a directory between those two hard drives, because one of the hard drives were not present anymore and rsync had the --delete parameter I end up deleting the whole directory, of course with precious informations. I have ufs on the hdd, after the accident I've turned off the computer to avoid any writings on the disk. Do you have any idea how can I recover the lost directory? Thank you! Laci Hi Laci, I'm sorry to have to tell you that recovering UFS is not easy. It's not like MS-DOS or NFTS at all in that respect. When you delete from UFS it removes inode data and adds the space released to the free block list. It's a one-way process; there is no journalling and no way to undo any of it. I don't know of any public domain utilities that will do what you need. EnCase can do something with UFS, and a utility called Raise Data Recovery will get stuff from damaged disks. This isn't the same as getting back deleted files. The only option I've ever found to work is to scan the disk's free blocks (all of them in your case) with a utility that recognises specific file formats and pieces the file together using the contents it reads from each block, using best guess and manual choice to decide which the next block is. This is no joke if you've lost a lot of files, but worth it if you have one or two vital ones amongst them. Sorry I can't be of any more comfort. As I'm sure someone will chip in, there are things you can do before the event. Regards, Frank. ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: ufs recovery
Hi Frank, Thank you very much for the information! Meanwhile I've found this software: http://www.ufsexplorer.com/, I'm going to give a try. Regards, Laci Sent from my mobile. On 2013.09.08., at 11:07, Frank Leonhardt freebsd-...@fjl.co.uk wrote: On 08/09/2013 09:46, Laszlo Danielisz wrote: Hi, By mistake I forgot to edit my crontab on my FreeBSD 8.3 after I took out one of the hard drives. I had a little rsync script which I used to synchronise a directory between those two hard drives, because one of the hard drives were not present anymore and rsync had the --delete parameter I end up deleting the whole directory, of course with precious informations. I have ufs on the hdd, after the accident I've turned off the computer to avoid any writings on the disk. Do you have any idea how can I recover the lost directory? Thank you! Laci Hi Laci, I'm sorry to have to tell you that recovering UFS is not easy. It's not like MS-DOS or NFTS at all in that respect. When you delete from UFS it removes inode data and adds the space released to the free block list. It's a one-way process; there is no journalling and no way to undo any of it. I don't know of any public domain utilities that will do what you need. EnCase can do something with UFS, and a utility called Raise Data Recovery will get stuff from damaged disks. This isn't the same as getting back deleted files. The only option I've ever found to work is to scan the disk's free blocks (all of them in your case) with a utility that recognises specific file formats and pieces the file together using the contents it reads from each block, using best guess and manual choice to decide which the next block is. This is no joke if you've lost a lot of files, but worth it if you have one or two vital ones amongst them. Sorry I can't be of any more comfort. As I'm sure someone will chip in, there are things you can do before the event. Regards, Frank. ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: ufs recovery
On 08/09/2013 10:39, Laszlo Danielisz wrote: On 2013.09.08., at 11:07, Frank Leonhardt freebsd-...@fjl.co.uk mailto:freebsd-...@fjl.co.uk wrote: On 08/09/2013 09:46, Laszlo Danielisz wrote: Hi, By mistake I forgot to edit my crontab on my FreeBSD 8.3 after I took out one of the hard drives. I had a little rsync script which I used to synchronise a directory between those two hard drives, because one of the hard drives were not present anymore and rsync had the --delete parameter I end up deleting the whole directory, of course with precious informations. I have ufs on the hdd, after the accident I've turned off the computer to avoid any writings on the disk. Do you have any idea how can I recover the lost directory? Thank you! Laci Hi Laci, I'm sorry to have to tell you that recovering UFS is not easy. It's not like MS-DOS or NFTS at all in that respect. When you delete from UFS it removes inode data and adds the space released to the free block list. It's a one-way process; there is no journalling and no way to undo any of it. I don't know of any public domain utilities that will do what you need. EnCase can do something with UFS, and a utility called Raise Data Recovery will get stuff from damaged disks. This isn't the same as getting back deleted files. The only option I've ever found to work is to scan the disk's free blocks (all of them in your case) with a utility that recognises specific file formats and pieces the file together using the contents it reads from each block, using best guess and manual choice to decide which the next block is. This is no joke if you've lost a lot of files, but worth it if you have one or two vital ones amongst them. Sorry I can't be of any more comfort. As I'm sure someone will chip in, there are things you can do before the event. Regards, Frank. Hi Frank, Thank you very much for the information! Meanwhile I've found this software: http://www.ufsexplorer.com/, I'm going to give a try. Regards, Laci That's the company that produces the Raise Data Recovery product I mentioned. However, I believe it's better for recovering data from a broken FS in the case of UFS2, not for undeleteing a whole directory/disk full of deliberately deleted files. I just checked, and it has a try-before-buy feature so you have nothing to lose. Good luck, and please keep us informed! FWIW I use Pandora for jobs similar to this, although it doesn't specifically support UFS. Piriform's Recuva also has its uses. But where UFS is involved I've failed to find a magic solution - just recovery from a backup unless it's one or two odd files. About the only thing you have going for you with UFS is the directory retains the file name after deletion if you haven't created any new files over it. But the inode (where it is on the disk) is another matter. Regards, Frank. ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
RE: ufs recovery
Assuming the disk has not been written to, then making a full DD image of the drive is your 1st step, then make a copy of that DD image and store it somewhere safe in case something goes wrong with the one you are working on. You can try Foremost which can recover data even deleted stuff from a DD image, there was another package that works on the command line but I cannot recall the name of it just now. Your success rate will depend on the type of data you are trying to recover, from experience foremost works better on certain types of files. Regards Graeme Dargie -Original Message- From: owner-freebsd-questi...@freebsd.org [mailto:owner-freebsd-questi...@freebsd.org] On Behalf Of Laszlo Danielisz Sent: 08 September 2013 09:47 To: FreeBSD Questions Subject: ufs recovery Hi, By mistake I forgot to edit my crontab on my FreeBSD 8.3 after I took out one of the hard drives. I had a little rsync script which I used to synchronise a directory between those two hard drives, because one of the hard drives were not present anymore and rsync had the --delete parameter I end up deleting the whole directory, of course with precious informations. I have ufs on the hdd, after the accident I've turned off the computer to avoid any writings on the disk. Do you have any idea how can I recover the lost directory? Thank you! Laci ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: ufs recovery
Thanks Graeme, Also my vga card is broken, probably tomorrow I'm getting a new one and I can give a try. On 2013 September 8 Sunday at 6:16 PM, Graeme Dargie wrote: Assuming the disk has not been written to, then making a full DD image of the drive is your 1st step, then make a copy of that DD image and store it somewhere safe in case something goes wrong with the one you are working on. You can try Foremost which can recover data even deleted stuff from a DD image, there was another package that works on the command line but I cannot recall the name of it just now. Your success rate will depend on the type of data you are trying to recover, from experience foremost works better on certain types of files. Regards Graeme Dargie -Original Message- From: owner-freebsd-questi...@freebsd.org [mailto:owner-freebsd-questi...@freebsd.org] On Behalf Of Laszlo Danielisz Sent: 08 September 2013 09:47 To: FreeBSD Questions Subject: ufs recovery Hi, By mistake I forgot to edit my crontab on my FreeBSD 8.3 after I took out one of the hard drives. I had a little rsync script which I used to synchronise a directory between those two hard drives, because one of the hard drives were not present anymore and rsync had the --delete parameter I end up deleting the whole directory, of course with precious informations. I have ufs on the hdd, after the accident I've turned off the computer to avoid any writings on the disk. Do you have any idea how can I recover the lost directory? Thank you! Laci ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org (mailto:freebsd-questions-unsubscr...@freebsd.org) ___ freebsd-questions@freebsd.org (mailto:freebsd-questions@freebsd.org) mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org (mailto:freebsd-questions-unsubscr...@freebsd.org) ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: ufs recovery
On Sun, 8 Sep 2013 11:39:08 +0200, Laszlo Danielisz wrote: Hi Frank, Thank you very much for the information! Meanwhile I've found this software: http://www.ufsexplorer.com/, I'm going to give a try. That program was on my famous list of recovery tools for futile attempts. :-) I may say that I have the same problem (of unclear origin). Files have been removed, but the assumption that the data could still be somewhere is alive. In such situations, you would usually have two choices: 1. money Get as much money as you can. You'll need it. Several 1000 euro / dollar / local currency will buy you service at a company specialized in recovery. There is no guarantee they will be successful. 2. time You invest time in learning how UFS works. There are many excellent articles (especially the authoritative one by M. K. McKusick). You try out different tools (with different scope). If you are lucky, you get your data back. (I was lucky once, got my data back!) There are _many_ good tools around. Most of them are free, so you don't need to invest massive amounts of money in a repeating trial error process. Allow me to repeat my list (which gets a little bit modified each time I post it to this list): OS tools: fetch -rR device recoverdisk Ports collection: ddrescue dd_rescue - use this to create images to work with magicrescue testdisk- restores content recoverjpeg foremost photorec ffs2recov scan_ffs tsk - The Sleuth Kit fls dls ils autopsy There are some commercial tools worth mentioning: UFS Explorer can be run in wine. It probably won't restore your data, but it can be used to determine if there is something to restore. Also consider R-Studio and R-Studio Emergency (live CD). Those offer free versions that can be used for testing. Finally, I'd like to mention The Sleuth Kit. It's one of the most powerful toolsets, also used in forensics and investigation. As I said, I ran into a similar problem (files deleted). Maybe you can find this discussion thread in the archives and gain some more inspiration from it. A massive data loss (meanwhile cured!) brought me to this list, so I continue to spread my experience about recovery when needed. :-) Good luck! -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ... ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
Re: ufs recovery
On Sun, Sep 08, 2013 at 10:46:35AM +0200, Laszlo Danielisz wrote: Hi, By mistake I forgot to edit my crontab on my FreeBSD 8.3 after I took out one of the hard drives. I had a little rsync script which I used to synchronise a directory between those two hard drives, because one of the hard drives were not present anymore and rsync had the --delete parameter I end up deleting the whole directory, of course with precious informations. Ouch. I have a similar procedure going. But I put it in a shell-script that mounts the destination _and_ checks if the destination is properly mounted _before_ starting the rsync. I would suggest you do something similar in the future. Just to be clear, was the information deleted from _both_ harddisks? I have ufs on the hdd, after the accident I've turned off the computer to avoid any writings on the disk. Do you have any idea how can I recover the lost directory? Do you perhaps have a snapshot of the filesystem in question available? If so, you can mount that and restore the files from it. See e.g.: http://www.freebsd.org/doc/handbook/snapshots.html If all else fails, have a look at sysutils/sleuthkit. Restoring deleted files on UFS is very difficult, but you can find some pointers here: http://wiki.sleuthkit.org/index.php?title=FS_Analysis#Manual_Deleted_File_Recovery It helps if you know what kind of data is contained in the deleted file. To prevent this from happening again, make regular backups e.g. to an external harddisk that you use for that purpose alone. Roland -- R.F.Smith http://rsmith.home.xs4all.nl/ [plain text _non-HTML_ PGP/GnuPG encrypted/signed email much appreciated] pgp: 1A2B 477F 9970 BA3C 2914 B7CE 1277 EFB0 C321 A725 (KeyID: C321A725) pgp56wP0pv4BG.pgp Description: PGP signature
