LinuxQuestions.org
LinuxAnswers - the LQ Linux tutorial section.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
Search this Thread
Old 09-14-2005, 06:37 PM   #1
DaFrEQ
Member
 
Registered: Mar 2002
Location: Earth... for now
Distribution: SuSE9.2 AMD64; LFS; GentooAMD64; Ubuntu10.04; RHEL 5.5; Solaris10(SPARC)
Posts: 418

Rep: Reputation: 30
Question Recovering deleted files??


Hiya all,

Got a quirky one here.
I was asked today, just a little bit ago, if I could find a way to recover some files that were deleted from the central storage server.

Here is the scenario:
The central server is running Linux, and a samba server. All local nodes can access the storage drives via their winbloz machines. They can all write to and delete from... (ya I know, but it isn't my network, and I didn't set it up)
Ok, so, most likely, someone was on a local wintendo machine, and deleted these files that now need to be "undeleted" so to speak.

Is there a way to recover such a loss? I don't have a whole lot of info on exactly what needs to be recovered, but I do know the name of at least one dir that was trashed.
Any ideas? or utilities that can be implemented?

Any help is gr8ly appreciated.
Tnx.
L8rz
 
Old 09-14-2005, 11:19 PM   #2
Matir
Moderator
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Ubuntu
Posts: 8,507

Rep: Reputation: 118Reputation: 118
Well, it depends on the filesystem in use on the server. However, if it's been running since the deletion... your chances get slimmer and slimmer. Every write could be overwriting the files deleted. And the fuller the drive, the greater the chances of this.
 
Old 09-15-2005, 11:08 AM   #3
DaFrEQ
Member
 
Registered: Mar 2002
Location: Earth... for now
Distribution: SuSE9.2 AMD64; LFS; GentooAMD64; Ubuntu10.04; RHEL 5.5; Solaris10(SPARC)
Posts: 418

Original Poster
Rep: Reputation: 30
Well, actualy it turns out that it isn't running Linux. It's running Unix. The exact flavor... I'm not quite sure.
Most likely a flavour of Solaris, tho 'm pretty sure it isn't the newer versions. (judging by the older solaris software sitting on the shelf)

However, the main problem is, they don't know the passwords to the server. So basically, when they have a problem and need to shutdown, they simply pull the plug. Litterally.
However, I'm sure I can find a way into the system via an ssh.

But, I'm not really remembering any unix utilities that will allow an admin to recover deleted stuff. At least nothing that is default with a Solaris package.
At any rate, I'm not sure that much can be done from this point.
But I'm still open to suggestions.

Tnx.
L8rz
 
Old 09-15-2005, 11:54 AM   #4
Matir
Moderator
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Ubuntu
Posts: 8,507

Rep: Reputation: 118Reputation: 118
The same sort of principles apply to Solaris as Linux. Though, if nobody has admin passwords, that spells bad news all over.
 
Old 09-15-2005, 12:34 PM   #5
halo14
Senior Member
 
Registered: Apr 2004
Location: Surprise, AZ
Distribution: Debian | CentOS | Arch
Posts: 1,103

Rep: Reputation: 45
so no one has root passwords... and people are deleting stuff... and I doubt you have daily backups then, right?? That's a big no-no... I think you are out of luck.
 
Old 09-16-2005, 02:31 PM   #6
DaFrEQ
Member
 
Registered: Mar 2002
Location: Earth... for now
Distribution: SuSE9.2 AMD64; LFS; GentooAMD64; Ubuntu10.04; RHEL 5.5; Solaris10(SPARC)
Posts: 418

Original Poster
Rep: Reputation: 30
Ya, well I already knew that not having the root pw was a big problem, and the fact that this situation even exists is a problem. Thanks for re-stating the obvious, and what I've already posted.

However, I can most likely obtain the pw's from the main office IF I can figure out a way to recover the files.
The storage server isn't written to and deleted from on a regular basis.

Again I remind you this isn't my network, nor did I set it up, so please stop with the "this is a big no no for security" issues.
Tnx.

L8rz
 
Old 09-16-2005, 03:34 PM   #7
halo14
Senior Member
 
Registered: Apr 2004
Location: Surprise, AZ
Distribution: Debian | CentOS | Arch
Posts: 1,103

Rep: Reputation: 45
You need to relax a little buddy. I was not being a jerk to you. I never said it was your fault or anything like that.

You also never stated whether there were backups being made. I assumed not because of the unorganized mess you had to walk in to.

Again, to the best of my knowledge, I think you'reout of luck. I didn't say you not having root password is a 'big no no for security'..I said that not having daily back-ups is a big no no on their part...

I hope you find something that will help you. I would also suggest writing up a plan of administration for the system.. when it is backed up.. when it is updated.. etc. Present it to the main office and see what they can do so this kind of situation doesn't happen again.

Good Luck
 
Old 09-16-2005, 09:58 PM   #8
DaFrEQ
Member
 
Registered: Mar 2002
Location: Earth... for now
Distribution: SuSE9.2 AMD64; LFS; GentooAMD64; Ubuntu10.04; RHEL 5.5; Solaris10(SPARC)
Posts: 418

Original Poster
Rep: Reputation: 30
Ya man, relaxing isn't part of this job... unfortunatly.
At any rate, I didn't mean to sound harsh.
I've already tried to get these people to "do the right thing" and all they end up doing is locking out the machines that don't have the problems. It's a real merry-go-round at times. It's a real 2-steps forward 3-steps backwards type scenario. Constantly. But, that's how office pukes usually run the show anyway... I mean they know best right?

Anywho, I've pretty much told them that they are skrewd because they didn't listen to the planning in the first place last year on the other vessels, so they only have themselves to blame.

Tnx for the help guys.
L8rz
 
Old 09-17-2005, 12:28 PM   #9
teckk
Senior Member
 
Registered: Oct 2004
Distribution: FreeBSD Arch
Posts: 1,753

Rep: Reputation: 189Reputation: 189
http://www.sleuthkit.org/
I don't know if that will do you any good, thought that I would post it.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Query: recovering deleted files... kevingpo Fedora 2 07-28-2005 07:11 PM
recovering deleted files saipraveen Linux - Newbie 1 06-16-2005 11:00 AM
recovering deleted files hamish Linux - Newbie 2 10-04-2004 05:51 PM
Recovering Deleted Files Brian of Gep Linux - Newbie 1 03-02-2004 02:26 AM
Need Help Fast...recovering Deleted Files dowdnt Linux - General 1 07-09-2003 09:14 AM


All times are GMT -5. The time now is 05:39 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration