You are not logged in.

#1 2011-05-16 22:22:40

apefish
Member
From: Vancouver
Registered: 2010-07-13
Posts: 47

I accidentally the whole filesystem

Some recent change somewhere caused my udev rules to mount all my partitions in media (before it was just removable stuff). I saw this but I thought it was just a bunch of junk directories left over from something else, so I did a 'sudo rm -r *'. it bugged me about deleting special files and stuff so I cancelled it. It seemed weird that there was special stuff in these junk directories. Then everything just came apart. Most of my files were gone, and programs wouldn't run. I realised what I had done and turned off the machine and took the drive out and attached it to my other machine.

I need to recover some files from that disk, how do I do it? It is an ext2 partition. Filesystem intact, but many files deleted. I've duckduckgo'd around and debugfs seems to be the thing to use. Unfortunately, I have no idea how to use it. If someone could help me with debugfs or suggest a better way, that would be great. If I manage to solve this, I promise to post everything for the benefit of future searchers.

My backups aren't quite up to date for the file I need. Learned a hard lesson there.

TL;DR: rm -r / on ext2. How to recover files?

Last edited by apefish (2011-05-16 22:23:24)

Offline

#2 2011-05-16 22:49:28

Inxsible
Forum Fellow
From: Chicago
Registered: 2008-06-09
Posts: 9,183

Re: I accidentally the whole filesystem

look into photorec


Forum Rules

There's no such thing as a stupid question, but there sure are a lot of inquisitive idiots !

Offline

#3 2011-05-16 23:27:59

apefish
Member
From: Vancouver
Registered: 2010-07-13
Posts: 47

Re: I accidentally the whole filesystem

Inxsible wrote:

look into photorec

Does that work for textfiles or only images and stuff?

I am using debugfs here, ls -d gives me a bunch of deleted filenames. How do I actually recover one (or more)?

I also tried e2undel but It didn't work.

debugfs: ls-d output:

 579361  (12) .    2  (12) ..    579362  (736) .bash_history   
<0> (20) .Xauthority   <0> (16) .xinitrc   <0> (12) mail   
<0> (24) .dmenu_cache   <0> (12) werc   <0> (16) .dmc   <0> (12) misc   
<0> (36) .rxvt-unicode-fairweather   <0> (16) .surf   <0> (16) .local   
<0> (24) .fontconfig   <0> (20) builds   <0> (20) .Xdefaults   
<0> (16) .adobe   <0> (28) .macromedia   <0> (16) movies   
<0> (24) .gstreamer-0.10   <0> (12) .pki   <0> (16) .conkyrc   <0> (16) music   
<0> (16) .fehbg   <0> (16) .dillo   <0> (24) derp.pdf   <0> (16) HOSTS   
<0> (16) resume   <0> (20) casestudy   <0> (24) udptftpserver.c   
<0> (20) .cache   <0> (12) bcit   <0> (12) pics   <0> (28) .gnuplot_history   
<0> (16) .mtpaint   <0> (28) .config   <0> (16) .hgrc   <0> (16) .pulse   
<0> (16) .zsnes   <0> (28) proj   <0> (16) gmon.out    679584  (52) roms   
<0> (40) .Xauthority-c   <103> (16) .links    669167  (24) irc   
 73615  (16) .getmail    579522  (44) 2011-05-15-131736_1024x768_scrot.png   
 660970  (16) .mplayer    579526  (20) .gnuplot-wxt    48965  (16) torrents   
 694179  (48) Downloads   <0> (28) .Xauthority-l   

The file I need is "casestudy".

Last edited by apefish (2011-05-16 23:29:24)

Offline

#4 2011-05-17 00:20:49

karol
Archivist
Registered: 2009-05-06
Posts: 25,440

Re: I accidentally the whole filesystem

Same story as https://bbs.archlinux.org/viewtopic.php?id=119087 but he has a recent backup.

Offline

#5 2011-05-17 01:33:47

Misfit138
Misfit Emeritus
From: USA
Registered: 2006-11-27
Posts: 4,189

Re: I accidentally the whole filesystem

This doesn't help, but I mean, it's 2011- why doesn't UNIX have an UNDELETE function yet? Ridiculous.

apefish wrote:

Does that work for textfiles or only images and stuff?

From the photorec website: "PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file system has been severely damaged or reformatted."

Offline

#6 2011-05-17 01:36:15

karol
Archivist
Registered: 2009-05-06
Posts: 25,440

Re: I accidentally the whole filesystem

Misfit138 wrote:

This doesn't help, but I mean, it's 2011- why doesn't UNIX have an UNDELETE function yet? Ridiculous.

Some semblance of the undelete function is one alias away: don't remove but move to trash :-)

Offline

#7 2011-05-17 01:47:19

Misfit138
Misfit Emeritus
From: USA
Registered: 2006-11-27
Posts: 4,189

Re: I accidentally the whole filesystem

karol wrote:
Misfit138 wrote:

This doesn't help, but I mean, it's 2011- why doesn't UNIX have an UNDELETE function yet? Ridiculous.

Some semblance of the undelete function is one alias away: don't remove but move to trash :-)

We all know this answer, and yet how much grief could be spared by the inclusion of a true, default undelete. I attribute the absence of such functionality to foolish stubbornness and pride. It is indefensible. An operating system is not a loaded gun nor a rope to hang oneself with. (At least, it shouldn't be.)

Interestingly, util-linux contains addpart, agetty, blockdev, cal, cfdisk, chfn, chkdupexe, chrt, chsh, col, colcrt, colrm, column, ctrlaltdel, cytune, ddate, delpart, display-services, dmesg, elvtune, fastboot, fasthalt, fdformat, fdisk, flock, fsck.cramfs, fsck.minix, getopt, halt, hexdump, hwclock, initctl, ionice, ipcrm, ipcs, isosize, kill, last, line, logger, login, look, losetup, mcookie, mesg, mkfs, mkfs.bfs, mkfs.cramfs, mkfs.minix, mkswap, more, mount, namei, need, newgrp, partx, pg, pivot_root, provide, ramsize, raw, rdev, readprofile, reboot, rename, renice, reset, rev, rootflags, script, scriptreplay, setsid, setterm, sfdisk, shutdown, simpleinit, swapoff, swapon, taskset, tailf, tunelp, ul, umount, vidmode, vipw, wall, whereis, and write...but no undelete.
The inclusion (and redundancy) of both cfdisk and fdisk is enough reason alone to expect something as trivial as an undelete program.

Offline

#8 2011-05-17 04:21:29

jlindgren
Member
Registered: 2011-02-27
Posts: 256

Re: I accidentally the whole filesystem

Misfit138 wrote:

This doesn't help, but I mean, it's 2011- why doesn't UNIX have an UNDELETE function yet? Ridiculous.

Ain't got no defragmenter either.  I guess, there just aren't enough people who are comfortable with the internals of a UNIX file system?  (I have a basic understanding of FAT; that's as far as I go.)

Anyway, yeah, try photorec.  I've used it on several occasions.

Offline

#9 2011-05-26 02:16:14

apefish
Member
From: Vancouver
Registered: 2010-07-13
Posts: 47

Re: I accidentally the whole filesystem

I used debugfs. debugfs lsdel allowed me to poke around in the deleted inodes. I sure am lucky I was looking for a text file. I would have had no clue which it was otherwise.

sorry for the delay.

Offline

#10 2011-05-26 09:13:43

ChoK
Member
From: France
Registered: 2008-10-01
Posts: 346

Re: I accidentally the whole filesystem


Ah, good taste! What a dreadful thing! Taste is the enemy of creativeness.
Picasso
Perfection is reached, not when there is no longer anything to add, but when there is no longer anything to take away.
Saint Exupéry

Offline

Board footer

Powered by FluxBB