You are not logged in.
Pages: 1
Some recent change somewhere caused my udev rules to mount all my partitions in media (before it was just removable stuff). I saw this but I thought it was just a bunch of junk directories left over from something else, so I did a 'sudo rm -r *'. it bugged me about deleting special files and stuff so I cancelled it. It seemed weird that there was special stuff in these junk directories. Then everything just came apart. Most of my files were gone, and programs wouldn't run. I realised what I had done and turned off the machine and took the drive out and attached it to my other machine.
I need to recover some files from that disk, how do I do it? It is an ext2 partition. Filesystem intact, but many files deleted. I've duckduckgo'd around and debugfs seems to be the thing to use. Unfortunately, I have no idea how to use it. If someone could help me with debugfs or suggest a better way, that would be great. If I manage to solve this, I promise to post everything for the benefit of future searchers.
My backups aren't quite up to date for the file I need. Learned a hard lesson there.
TL;DR: rm -r / on ext2. How to recover files?
Last edited by apefish (2011-05-16 22:23:24)
Offline
look into photorec
There's no such thing as a stupid question, but there sure are a lot of inquisitive idiots !
Offline
look into photorec
Does that work for textfiles or only images and stuff?
I am using debugfs here, ls -d gives me a bunch of deleted filenames. How do I actually recover one (or more)?
I also tried e2undel but It didn't work.
debugfs: ls-d output:
579361 (12) . 2 (12) .. 579362 (736) .bash_history
<0> (20) .Xauthority <0> (16) .xinitrc <0> (12) mail
<0> (24) .dmenu_cache <0> (12) werc <0> (16) .dmc <0> (12) misc
<0> (36) .rxvt-unicode-fairweather <0> (16) .surf <0> (16) .local
<0> (24) .fontconfig <0> (20) builds <0> (20) .Xdefaults
<0> (16) .adobe <0> (28) .macromedia <0> (16) movies
<0> (24) .gstreamer-0.10 <0> (12) .pki <0> (16) .conkyrc <0> (16) music
<0> (16) .fehbg <0> (16) .dillo <0> (24) derp.pdf <0> (16) HOSTS
<0> (16) resume <0> (20) casestudy <0> (24) udptftpserver.c
<0> (20) .cache <0> (12) bcit <0> (12) pics <0> (28) .gnuplot_history
<0> (16) .mtpaint <0> (28) .config <0> (16) .hgrc <0> (16) .pulse
<0> (16) .zsnes <0> (28) proj <0> (16) gmon.out 679584 (52) roms
<0> (40) .Xauthority-c <103> (16) .links 669167 (24) irc
73615 (16) .getmail 579522 (44) 2011-05-15-131736_1024x768_scrot.png
660970 (16) .mplayer 579526 (20) .gnuplot-wxt 48965 (16) torrents
694179 (48) Downloads <0> (28) .Xauthority-l
The file I need is "casestudy".
Last edited by apefish (2011-05-16 23:29:24)
Offline
Same story as https://bbs.archlinux.org/viewtopic.php?id=119087 but he has a recent backup.
Offline
This doesn't help, but I mean, it's 2011- why doesn't UNIX have an UNDELETE function yet? Ridiculous.
Does that work for textfiles or only images and stuff?
From the photorec website: "PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file system has been severely damaged or reformatted."
Offline
This doesn't help, but I mean, it's 2011- why doesn't UNIX have an UNDELETE function yet? Ridiculous.
Some semblance of the undelete function is one alias away: don't remove but move to trash :-)
Offline
Misfit138 wrote:This doesn't help, but I mean, it's 2011- why doesn't UNIX have an UNDELETE function yet? Ridiculous.
Some semblance of the undelete function is one alias away: don't remove but move to trash :-)
We all know this answer, and yet how much grief could be spared by the inclusion of a true, default undelete. I attribute the absence of such functionality to foolish stubbornness and pride. It is indefensible. An operating system is not a loaded gun nor a rope to hang oneself with. (At least, it shouldn't be.)
Interestingly, util-linux contains addpart, agetty, blockdev, cal, cfdisk, chfn, chkdupexe, chrt, chsh, col, colcrt, colrm, column, ctrlaltdel, cytune, ddate, delpart, display-services, dmesg, elvtune, fastboot, fasthalt, fdformat, fdisk, flock, fsck.cramfs, fsck.minix, getopt, halt, hexdump, hwclock, initctl, ionice, ipcrm, ipcs, isosize, kill, last, line, logger, login, look, losetup, mcookie, mesg, mkfs, mkfs.bfs, mkfs.cramfs, mkfs.minix, mkswap, more, mount, namei, need, newgrp, partx, pg, pivot_root, provide, ramsize, raw, rdev, readprofile, reboot, rename, renice, reset, rev, rootflags, script, scriptreplay, setsid, setterm, sfdisk, shutdown, simpleinit, swapoff, swapon, taskset, tailf, tunelp, ul, umount, vidmode, vipw, wall, whereis, and write...but no undelete.
The inclusion (and redundancy) of both cfdisk and fdisk is enough reason alone to expect something as trivial as an undelete program.
Offline
This doesn't help, but I mean, it's 2011- why doesn't UNIX have an UNDELETE function yet? Ridiculous.
Ain't got no defragmenter either. I guess, there just aren't enough people who are comfortable with the internals of a UNIX file system? (I have a basic understanding of FAT; that's as far as I go.)
Anyway, yeah, try photorec. I've used it on several occasions.
Offline
I used debugfs. debugfs lsdel allowed me to poke around in the deleted inodes. I sure am lucky I was looking for a text file. I would have had no clue which it was otherwise.
sorry for the delay.
Offline
Ah, good taste! What a dreadful thing! Taste is the enemy of creativeness.
Picasso
Perfection is reached, not when there is no longer anything to add, but when there is no longer anything to take away.
Saint Exupéry
Offline
Pages: 1