LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
Search this Thread
Old 06-21-2006, 05:57 AM   #1
finferflu
LQ Newbie
 
Registered: Jun 2006
Location: Manchester, UK
Distribution: Debian Etch / Ubuntu Feisty Fawn
Posts: 26

Rep: Reputation: 15
Exclamation Recovering deleted files on vfat partition


Hi,

I have a huge problem. I was trying to remove some folders from my vfat partition (/media/hda1) from command line, using the command

rm -rf FOUND*

because there were a lot of folders called FOUND001, FOUND002 and so on.

After a bit of loading, I found out that my whole partition was gone!
I have no clue of what happened, but now I just want to retrieve my files, even because this machine is also used by another person.

Searching on Google and in this Forum, I found solutions that were suitable only for ext filesystems, so, I would like to know if there is anything I could do for a vfat filesystem.

Note that I haven't got any recovery disk, and stuff like that. I would like to undelete everything, and basically take one step back, if possible.

Is it possible to do that?


By the way, my Distro is Knoppix 5.0.1

Thank you very much for your time.

Last edited by finferflu; 06-21-2006 at 08:44 AM.
 
Old 06-21-2006, 07:14 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,987
Blog Entries: 54

Rep: Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742
Search sourceforge.net for "foremost", then search LQ for foremost practical examples if necessary.


Good luck.
 
Old 06-21-2006, 07:59 AM   #3
finferflu
LQ Newbie
 
Registered: Jun 2006
Location: Manchester, UK
Distribution: Debian Etch / Ubuntu Feisty Fawn
Posts: 26

Original Poster
Rep: Reputation: 15
Unhappy

Thanks for your reply.

I tried to run it, but I had no result. This is what I did:

Code:
mmanu@scatoletta:~$ foremost -a -d -v -T -t all -i /dev/hda1 -o /tmp/foremost
Foremost version 1.2 by Jesse Kornblum, Kris Kendall, and Nick Mikus
Audit File

Foremost started at Wed Jun 21 13:51:10 2006
Invocation: foremost -a -d -v -T -t all -i /dev/hda1 -o /tmp/foremost
Output directory: /tmp/foremost_Wed_Jun_21_13_51_10_2006
Configuration file: /etc/foremost.conf
Processing: stdin
|------------------------------------------------------------------
File: stdin
Start: Wed Jun 21 13:51:10 2006
Length: Unknown

Num      Name (bs=512)         Size      File Offset     Comment
And no files, it seems like it did not find anything, also the folder /tmp/foremost_Wed_Jun_21_13_51_10_2006 is empty, with only empty folders named by file type.

---edit---
I noted that foremost is trying to read from stdin, and this is what I read in the man pages:

Quote:
-i file

The file is used as the input file. If no input file is specified or the input file cannot be read then stdin is used.
So, I don't understand why it can't read /dev/hda1, I wonder if that means that there is nothing to read, and thus, all information is lost forever.

Note that at the beginning I was not thinking straight, so I rebooted inserting the Windows XP CD into the drive, trying to see if I could do anything, but then I changed my mind and rebooted while it was still loading, and I hope I didn't make the deletion irreversible.

Last edited by finferflu; 06-21-2006 at 08:16 AM.
 
Old 06-21-2006, 11:02 AM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,987
Blog Entries: 54

Rep: Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742
mmanu@scatoletta:~$
For unrestricted access to devices under GNU/Linux means you need to be(come) root.


foremost -a -d -v -T -t all -i /dev/hda1 -o /tmp/foremost
Without the "-T" flag this works for me. I'm not sure you need the "-d" flag too.


I wonder if that means that there is nothing to read, and thus, all information is lost forever.
It's really too soon to draw conclusions. After all deleting files in VFAT is a less severe form of destruction compared to say repartitioning and reformatting.


Note that at the beginning I was not thinking straight, so I rebooted inserting the Windows XP CD into the drive, trying to see if I could do anything, but then I changed my mind and rebooted while it was still loading, and I hope I didn't make the deletion irreversible.
There's basically two things that help chances of recovery: an as short as possible period between deletion and recovery, and fixation of the data. The shorter the period the less chance there is data will be written over and making the drive read-only ensures similar but also guards against OSes trying to "correct" problems. Of course this all goes for "old" filesystems like VFAT and not for journalling fses.

All a regular shutdown or reboot will flush & sync, which isn't what you want, but rebooting an O.S. that would try to run fsck/chkdisk could diminish chances, yes. Still it's to early to draw conclusions. Try as root first I'd say.
 
Old 06-21-2006, 11:21 AM   #5
finferflu
LQ Newbie
 
Registered: Jun 2006
Location: Manchester, UK
Distribution: Debian Etch / Ubuntu Feisty Fawn
Posts: 26

Original Poster
Rep: Reputation: 15
Ok, you are right, I should have tried also as root-user before posting, but still, no positive results (at least it gets the output from /dev/hda1):

Code:
root@scatoletta:/# foremost -a -v -T -t all -i /dev/hda1 -o /tmp/foremost
Foremost version 1.2 by Jesse Kornblum, Kris Kendall, and Nick Mikus
Audit File

Foremost started at Wed Jun 21 17:18:23 2006
Invocation: foremost -a -v -T -t all -i /dev/hda1 -o /tmp/foremost
Output directory: /tmp/foremost_Wed_Jun_21_17_18_23_2006
Configuration file: /etc/foremost.conf
Processing: /dev/hda1
|------------------------------------------------------------------
File: /dev/hda1
Start: Wed Jun 21 17:18:23 2006
Length: 32 GB (34760001024 bytes)

Num      Name (bs=512)         Size      File Offset     Comment

|
Finish: Wed Jun 21 17:18:23 2006

0 FILES EXTRACTED

------------------------------------------------------------------

Foremost finished at Wed Jun 21 17:18:23 2006
 
Old 06-21-2006, 06:56 PM   #6
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,987
Blog Entries: 54

Rep: Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742
That is absolutely weird. Even if "clean" you can nearly always fish something out of VFAT's. You are sure the partition is mounted read-only right? And you are sure there has been no chkdisk running on it? Percentage-wise speaking, what type of files where on the partition that foremost has no header files for? Do you have another physical disk or external one that has enough free space, (twice the partition, say 60GB)?
 
Old 06-22-2006, 03:32 PM   #7
finferflu
LQ Newbie
 
Registered: Jun 2006
Location: Manchester, UK
Distribution: Debian Etch / Ubuntu Feisty Fawn
Posts: 26

Original Poster
Rep: Reputation: 15
Ah, sorry, I did not understand I had to mount hda1 read-only, I am really sorry about that.

Anyway, I'm getting something now, even though I can't visualise it (i.e. .jpg files are blank pictures, and I can't open .doc files), but foremost stops with an error message because there is not enough space on the partition I am using, so I guess that everything should be readable when foremost stops properly, or at least I hope so.

I am currently using a laptop, and I have no clue of how to add an hard drive, and I was thinking to split the process in different sections (I think there is an option for that), and burn all the files on CDs or DVDs in stages.

But I am not really sure about this solution because if stop the search to a certain block and a file is between that block and another, it will be damaged.

Last edited by finferflu; 06-22-2006 at 03:56 PM.
 
Old 06-22-2006, 06:24 PM   #8
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,987
Blog Entries: 54

Rep: Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742
Ah, sorry, I did not understand I had to mount hda1 read-only
Well, not for reading (as you can just read the raw /dev/hda1) but to guard against inadvertedly changing any data on it.


Anyway, I'm getting something now, even though I can't visualise it (..) foremost stops with an error message because there is not enough space on the partition I am using, so I guess that everything should be readable when foremost stops properly, or at least I hope so.
Not to temper your hopes, but there's no "magical cure". Not everything will be readable.


I am currently using a laptop, and I have no clue of how to add an hard drive, and I was thinking to split the process in different sections (I think there is an option for that), and burn all the files on CDs or DVDs in stages.
No chance to add external USB storage? If you have a HD somewhere, USB cases are quite cheap.


But I am not really sure about this solution because if stop the search to a certain block and a file is between that block and another, it will be damaged.
Me neither. Could restart a few blocks before the stop.
 
Old 06-24-2006, 07:17 AM   #9
finferflu
LQ Newbie
 
Registered: Jun 2006
Location: Manchester, UK
Distribution: Debian Etch / Ubuntu Feisty Fawn
Posts: 26

Original Poster
Rep: Reputation: 15
Ok, thanks for the hints.

I am now looking for an usb hard drive, I think that will do the job, I just hope to find a model that is compatible with linux.

Thank you very much for your precious help ^__^
 
Old 06-25-2006, 03:31 PM   #10
unSpawn
Moderator
 
Registered: May 2001
Posts: 26,987
Blog Entries: 54

Rep: Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742Reputation: 2742
just hope to find a model that is compatible with linux
Any well-known brand definately has the vendor id in the USB agent database, so that should prove no prob.


Thank you very much for your precious help
N.P. that's what we're here for...
 
  


Reply

Tags
retrieve, rm, undelete, vfat


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Recovering Deleted files brew1brew Mandriva 6 12-24-2005 01:21 PM
Recovering deleted files?? DaFrEQ Linux - General 8 09-17-2005 12:28 PM
recovering deleted files saipraveen Linux - Newbie 1 06-16-2005 11:00 AM
recovering deleted files hamish Linux - Newbie 2 10-04-2004 05:51 PM
Recovering Deleted Files Brian of Gep Linux - Newbie 1 03-02-2004 02:26 AM


All times are GMT -5. The time now is 07:22 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration