Made a huge, dumb mistake

xelados · 2007-09-11 23:04:02

Hi. I was trying to get rid of the files in another user's home directory when I accidentally put too many .'s behind the slash (I had cd'd into the user's dir to see what was in it). So, I ended up "rm -r"ing my /home. It's kinda funny since I thought I had a backup, but I don't. So.. is there any way to reverse this? I've used Google and someone suggested "ufsrestore" on another forum, but I dunno if Arch has that.

It'd be great if I could restore this stuff. I have a lot of settings I can't easily reproduce.. I did find something, though, that will prevent me from doing something that stupid again; aliasing "rm" and "mv" as "rm -i" and "mv -i". I'll be doing that as soon as I get my files back (or find that I'm ****ed).

mac57 · 2007-09-11 23:11:48

My guess is those files are permanently lost. What file system are you using? Perhaps there is a tool that may help "undelete", but I am not aware of it. However, if you tell us what file system you are using, perhaps one of the more expert folks here can give you a hand. We can always hope!

xelados · 2007-09-11 23:12:11

My filesystem is ext3 with journaling.

AriciU · 2007-09-11 23:17:29

Bye bye. They are lost forever... you cannot recover from EXT3. That's why i use EXT2 for downloads and stored stuff.

Be more carefull next time... i rm -rf'ed my /etc folder once by mistake so you got off easy with /home

mac57 · 2007-09-11 23:18:06

Well, it doesn't look hopeful. I googled "ext3 undelete" and immediately found this in a FAQ:

Q: How can I recover (undelete) deleted files from my ext3 partition?
Actually, you can't! This is what one of the developers, Andreas Dilger, said about it:

In order to ensure that ext3 can safely resume an unlink after a crash, it actually zeros out the block pointers in the inode, whereas
ext2 just marks these blocks as unused in the block bitmaps and marks the inode as "deleted" and leaves the block pointers alone.

Your only hope is to "grep" for parts of your files that have been deleted and hope for the best.

kagerato · 2007-09-11 23:21:22

Generally, you can recover at some deleted data from certain filesystems -- at least until it's overwritten (after being overwritten, you need professional forensic hardware to examine the disk). The deletion only updates the filesystem inodes, it doesn't purge the data from the disk. Without the inodes, however, there is no direct way to access the deleted data -- those records are the metadata that tracks the location and size of the data in each file.

The major question is, what filesystem were you using? ext2 is easier to recover data from than ext3, because it doesn't destroy the inode data as thoroughly/immediately.

Here's some links:

http://batleth.sapienti-sat.org/project … 3-faq.html
http://www.linuxquestions.org/questions … p?t=539141
http://web.glandium.org/blog/?p=87
http://www.ibiblio.org/pub/Linux/docs/H … etion.html
http://antrix.net/journal/techtalk/reis … o.comments
http://recover.sourceforge.net/linux/

Best advice, however, is to keep proper backups of any data that you feel is even mildly important. I usually keep two removable media copies; one on optical disc (read-only) and another on flash.

FeatherMonkey · 2007-09-11 23:21:47

Firstly this is far from the truth and is constantly reported. Next this is also far from easy I never quite succeeded.

Here's the info I collated on the said subject, but this is really approaching PC forensics. Involves data carving and all kinds of tricks.

So in trying to undelete something I came across a couple of snippets. Now expect mileage to vary, firstly I was trying a Directory on a live sysytem which I shouldn't of done but was more curious than actually trying.

So first we need http://www.sleuthkit.org/autopsy/desc.php this is then used, though several bits can also be achieved with debugfs
http://www.sage.org/lists/sage-members- … 00406.html This suggests if just done get the system offline and using just debufs.

This didn't quite work for me though did list some deleted inodes.
Now firstly this isn't easy.
http://www.lonerunners.net/blog/index.p … D=undelete

So now using this with a dd image(What I didn't do, though I suspect the space was already gone), now having followed the above you should hopefully of ended up with a file that'll need carving I used http://foremost.sourceforge.net/ .

Another similar howto also here http://linux.sys-con.com/read/117909_1.htm

This isn't complete as one I'm not sure. I didn't manage to find the inode or was looking in the wrong place but I did recover something I did have files in a zip format, just not the ones I wanted.

So perhaps if you're just interested or have something that you really do wish to recover and don't wish to pay the prices, here's an avenue or at least a start in the right direction.

Also far more detailed docs here http://www.porcupine.org/forensics/fore … pter4.html also with more info at 4.10 in regards to whats actually happening on deletion.

Last edited by FeatherMonkey (2007-09-11 23:47:41)

xelados · 2007-09-11 23:23:02

Yeah, I'm gonna learn cron after I restore my stuff and start making regular backups to my SD card.

So, would you guys say that since ext3 clears the inodes so quickly that I may as well cut my losses and start over?

somairotevoli · 2007-09-11 23:23:13

You could try magicrescue in AUR:
http://aur.archlinux.org/packages.php?d … s=0&SeB=nd

I have had very little luck w/ it, but I only used it once to try and recover some avi files. It found a few pieces only:(

xelados · 2007-09-11 23:30:46

somairotevoli: I have the tarball and the pkgbuild.. what do I do now? I'm alos using Arch64, if that matters.

kagerato · 2007-09-11 23:31:01

xelados wrote:

So, would you guys say that since ext3 clears the inodes so quickly that I may as well cut my losses and start over?

If the data lost can be obtained again in some fashion, or if it wasn't critical to begin with, yes. If the data was valuable enough to be worth paying to recover, then you should look into commercial data recovery solutions or outright hard drive forensics.

xelados · 2007-09-11 23:39:32

Well, the data I mainly care about is my package settings, such as vim, fluxbox, etc. and my photos. I have my music and web development stuff stored on my mp3 player and website respectively. I had Apache store its things under /home, too, however, so I'll need to find a way to repair that.

I'll be needing to write some new scripts and stuff, too.. I'm not sure if recovering the data is worth the effort, and apparently magicrescue couldn't build for me. It said /bin/sh was a bad interpreter and that I had no makefile when I downloaded the pkgbuild and tarball, used "makepkg <pkgname>" and changed the pkgbuild to reflect my architecture.

somairotevoli · 2007-09-11 23:41:49

xelados wrote:

somairotevoli: I have the tarball and the pkgbuild.. what do I do now? I'm alos using Arch64, if that matters.

extract the tarball > cd to the extracted directory > type

makepkg

(may have to be root if you don't have fakeroot installed)
After package is finished building:

type pacman -A nameofpackage.pkg.tar.gz

more info here: http://wiki.archlinux.org/index.php/AUR … se_the_AUR

AriciU · 2007-09-11 23:44:54

Trust me, you are wasting your time. Back when i deleted my /etc folder i tried numerous programs (paid data recovery tools... professional stuff) to try to and find one that could recover data from EXT3 partitions. I even talked with some of the developers and they all said that it's not possible to recover anything from EXT3 becose of journaling. Ext2 would've been no problem...

Just start over...

xelados · 2007-09-11 23:51:49

Alright then. I guess I'll start from square one. I regret the loss of the files, but I suppose this loss is worth it as long as I learn something and can prevent it from happening again. Thanks for the suggestions and input, guys.

elgatofelix · 2007-09-12 01:42:42

AriciU wrote:

Bye bye. They are lost forever... you cannot recover from EXT3. That's why i use EXT2 for downloads and stored stuff.
Be more carefull next time... i rm -rf'ed my /etc folder once by mistake so you got off easy with /home

dude you got easy !!

elgatofelix · 2007-09-12 01:46:00

blame if i am lying .. i remember i ve readed a article in net about this.
the steps where somethin like:
dont ever touch fs
dd_rescue the partition ( or dd if u hav no errors in fs )
then make a fsck to the iso with some kind of params to undelete files
loop mount: extract the files that where "recovered" if u are lucky

Last edited by elgatofelix (2007-09-12 01:48:10)

MrWeatherbee · 2007-09-12 02:28:36

elgatofelix wrote:

blame if i am lying .. i remember i ve readed a article in net about this.
the steps where somethin like:
dont ever touch fs
dd_rescue the partition ( or dd if u hav no errors in fs )
then make a fsck to the iso with some kind of params to undelete files
loop mount: extract the files that where "recovered" if u are lucky

You weren't dreaming (or lying ). There is such a process, I have tested it but have not had to put it to use in a real catastrophe. Also, the process you describe has most often been suggested for ReiserFS ... not ext3 ... at least for the discussions I am aware of. For example:

http://antrix.net/journal/techtalk/reis … o.comments

The process of creating an image to work on during the recovery process might be adapted to ext3 with good effect, but a lot of the other information in the article is ReiserFS specific.

My main interest in the process was using it to determine to my own satisfaction whether secure-deletion utilities worked on journaled file systems. Lots of contradictory info exists, most saying the utilities don't work (including strong caveats from the author's of the various tools), but some have made claims that the default journaling mode (Journal Data Ordered) in ext3 and ReiserFS does allow the utilities to work.

With the process linked to above, I was able to fairly consistently recover deleted data from my ReiserFS partitions. I tested with 'wipe', 'srm', 'shred', and regular 'rm'. While I could recover files that had been specifically secure-deleted, overwriting the free-space after any specific file deletions (using any of the deletion tools to delete the files) would result in inability to recover files by any method I tried. I'm sure experts may be able to carry this further, but I was just playing around with readily available tools. I also lost interest after satisfying myself to some degree about ReiserFS (which is what I normally use) and never continued the testing with any other file system.

Though it may be too late for Xelados, I did find this information specifically related to ext3 over at LinuxQuestions.org (see post #4 especially):

http://www.linuxquestions.org/questions … ost2687541

The author of that post had some success with the various methods he tried, though as others have pointed out in this thread, any recovery effort will only be worth it depending on how valuable the lost files are.

pelle.k · 2007-09-12 10:28:54

So how will ext4 be in this regard? Am i still going to be screwed if i make a mistake?

FeatherMonkey · 2007-09-12 11:24:01

I wouldn't expect it to change there's a fundamental difference linux is designed for the enterprise.

Which means backups, lots of backups, 2 different drives just to be safe.

Or do what I do but its not really recommended (You may get the odd program misbehave, certainly during install, meaning you need to unalias) I've aliased rm to my trash bin.

iphitus · 2007-09-12 11:40:04

FeatherMonkey wrote:

I wouldn't expect it to change there's a fundamental difference linux is designed for the enterprise.
Which means backups, lots of backups, 2 different drives just to be safe.
Or do what I do but its not really recommended (You may get the odd program misbehave, certainly during install, meaning you need to unalias) I've aliased rm to my trash bin.

careful, you probably know that's not a substitute for a backup. The only thing it prevents is you, or a shell script from rm'ing things. If an application, or anything else calls for a remove via their respective library, it's gone.

James

FeatherMonkey · 2007-09-12 11:57:25

I know it isn't, did cause me a little headache but as you said Backups I agree.

But this is a toy so it doesn't really matter, can always try to fix it, as you said anything I really want I just backup.

Certainly my alias is not to be relied on but handy for those odd mistakes made with rm. But as mentioned I actually had something install calling rm -rf caught me out for a moment couldn't work out why kfmclient was not taking -rf. lol

mac57 · 2007-09-12 19:31:23

In the end, as someone said, there is NO substitute for a good and regularly exercised backup strategy. I am fond of saying that you are only borrowing any piece of data that you have just one copy of, until the next [disk error, system crash... your catastrophe here] takes it out. Backing up, while painful, is critical. It has saved me from numerous boneheaded errors I have made over the years. Unfortunately, we all have to experience one or two painful data losses before we are willing to undertake the routine pain of backing up... of course that pain is a LOT less than the pain associated with losing valued data such as photos!

Last edited by mac57 (2007-09-12 19:32:20)

Misfit138 · 2007-09-12 20:10:29

FeatherMonkey wrote:

I've aliased rm to my trash bin.

Very, very clever...I like that idea.

Arch Linux

#1 2007-09-11 23:04:02

Made a huge, dumb mistake

#2 2007-09-11 23:11:48

Re: Made a huge, dumb mistake

#3 2007-09-11 23:12:11

Re: Made a huge, dumb mistake

#4 2007-09-11 23:17:29

Re: Made a huge, dumb mistake

#5 2007-09-11 23:18:06

Re: Made a huge, dumb mistake

#6 2007-09-11 23:21:22

Re: Made a huge, dumb mistake

#7 2007-09-11 23:21:47

Re: Made a huge, dumb mistake

#8 2007-09-11 23:23:02

Re: Made a huge, dumb mistake

#9 2007-09-11 23:23:13

Re: Made a huge, dumb mistake

#10 2007-09-11 23:30:46

Re: Made a huge, dumb mistake

#11 2007-09-11 23:31:01

Re: Made a huge, dumb mistake

#12 2007-09-11 23:39:32

Re: Made a huge, dumb mistake

#13 2007-09-11 23:41:49

Re: Made a huge, dumb mistake

#14 2007-09-11 23:44:54

Re: Made a huge, dumb mistake

#15 2007-09-11 23:51:49

Re: Made a huge, dumb mistake

#16 2007-09-12 01:42:42

Re: Made a huge, dumb mistake

#17 2007-09-12 01:46:00

Re: Made a huge, dumb mistake

#18 2007-09-12 02:28:36

Re: Made a huge, dumb mistake

#19 2007-09-12 10:28:54

Re: Made a huge, dumb mistake

#20 2007-09-12 11:24:01

Re: Made a huge, dumb mistake

#21 2007-09-12 11:40:04

Re: Made a huge, dumb mistake

#22 2007-09-12 11:57:25

Re: Made a huge, dumb mistake

#23 2007-09-12 19:31:23

Re: Made a huge, dumb mistake

#24 2007-09-12 20:10:29

Re: Made a huge, dumb mistake

Board footer