Data Recovery

Ryujin · 2006-08-10 20:44:01

Some inportaint files were accidentily deleted, and I would like to get them back, how would I go about doing this? I am using reiser3, thanks!

ralvez · 2006-08-10 23:18:07

Take a look at this see if it helps.

http://www.samag.com/documents/s=7033/s … m0204g.htm

Ryujin · 2006-08-10 23:25:27

this is very helpful and might do the trick, but I wonder if there is a program to do all this stuff, and if not, why? or rather, what prevents it?

ralvez · 2006-08-10 23:36:14

I'm not a data recovery expert (by any stretch of the imagination ) but data recovery is a very specialized field. While there are some tools tailored for data recovery in Linux, used in data forensic analysis, they are not chip.

Thinking of it, I do not know of any that is free (for reiserfs) ... perhaps someone it this forum knows?

BTW, even if you find one (free I mean) you should not install it in the same HDD you want to recover files from or you may overwrite the files you are trying to save.

ralvez · 2006-08-10 23:47:58

You just made my curiosity itch and I went googling ... and I found that there are tools and tutorials for reiserfs.
Thake a look at this:
http://antrix.net/journal/techtalk/reis … o.comments

I also found this from some web forum:

Bad news, there is no reiserfs undelete. But you can try the following procedure :
Unmount that partition. e.g., umount /home
Find out what actual device this partition refers to. You can usually get this information from the file /etc/fstab. We'll assume here that the device is /dev/hda3.
Run the command: reiserfsck --rebuild-tree -S -l /root/recovery.log /dev/hda3
You need to be root to do this. Read the reiserfsck man page for what these options do and for more options. Some interesting options are '--rebuild-sb, --check'
After the command finishes, which might be a long time for a big partition, you can take a look at the logfile /root/recovery.log if you wish.
Mount your partition: mount /home
Look for the lost+found directory in the root of the partition. Here, that would be:
/home/lost+found
This directory contains all the files that could be recovered. Unfortunately, the filenames are not preserved for a lot of files. You'll find some sub-directories - filenames withing those are preserved!
Look through the files and copy back what you need.

And this also seems promising:

http://linux.editme.com/how-do-i-undelete-files

Hope this helps.

Rick

Arch Linux

#1 2006-08-10 20:44:01

Data Recovery

#2 2006-08-10 23:18:07

Re: Data Recovery

#3 2006-08-10 23:25:27

Re: Data Recovery

#4 2006-08-10 23:36:14

Re: Data Recovery

#5 2006-08-10 23:47:58

Re: Data Recovery

Board footer