LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices



Reply
 
Search this Thread
Old 04-02-2010, 08:47 AM   #1
ytd
Member
 
Registered: Jan 2009
Posts: 189

Rep: Reputation: 31
Recovery deleted folders and files when using rm -rf command


Hello everyone,

I disperately need to recover some folders and some files from my CentOS 5.3 X86_64 linux machine ext3 partition after I have deteled them with rm -rf command.

After I have deleted the files (*.exp extension) and folders with rm -rf command, I have written a big archive 70GB on the same partitions but in a different path. I know that in windows if I do that, there's no way I can bring back the deleted files, 'cause the OS writes the information in the same cluster and therefor I can't bring back the files. I hope you guys understand what am I saying.

My question is, what program (that knows all extensions, or dosen't read a specific extension/extensions) can I use in order to get the date back ? I have used foremost and it worked, but this programs knows only specific extensions, like exe, jpg, avi, mpeg, etc and not my *.exp extension. The foremost program worked perfectly, but it dosen't know the *.exp extension that I need, in order to get the data back that has that extension.

I'm sorry for my english, but it's not my 1st language, and I don't write well.

Thank you in advance and I hope I will get a fast and a good answer. I need this kind of info urgent.
 
Old 04-02-2010, 08:56 AM   #2
frndrfoe
Member
 
Registered: Jan 2008
Distribution: RHEL, CentOS
Posts: 375

Rep: Reputation: 38
You can use foremost to recover any file type, you just have to do a little homework first. Specifically you will need to know the file header and footer hex code and then you can add it to foremost.conf.
You could probably copy a sample file to a flash drive and examine it to get that info, or it may be available on the web somewhere.

You will still run into the same issue of the blocks being over written by the newer data though.

Last edited by frndrfoe; 04-02-2010 at 08:58 AM.
 
Old 04-02-2010, 08:58 AM   #3
jschiwal
Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 655Reputation: 655Reputation: 655Reputation: 655Reputation: 655Reputation: 655
If you have recovered a large number of files but not the file names w/extensions you can use the `file' command to determine what type a file is.
 
Old 04-03-2010, 04:13 AM   #4
ytd
Member
 
Registered: Jan 2009
Posts: 189

Original Poster
Rep: Reputation: 31
frndrfoe:

header and footer hex code ? wtf is that ? I only know the extension, if you reffer to that. Give me an example pls. My files extensions that were in folders(directoryes) had extension with *.exp
What should I write and where should I write in foremost.conf in order to get the data back ?
I can obtain the header and footer hex code if I copy an example of that data (I do have an example) by copying the example of data to a flash memory how ? Can you be more specific pls ?

jschiwal:

I didn't recover nothing, 'cause the foremost program recover only known extensions, avi, mpeg, blalvlabv and the directory of the deleted files contains only .*.exp extensions

Pls, what command should I use and what and where in the foremost.conf I need to write to get data back ?

I don't have time ,my time is 100% ocupied, can'd do tests.
 
Old 04-03-2010, 10:50 AM   #5
frndrfoe
Member
 
Registered: Jan 2008
Distribution: RHEL, CentOS
Posts: 375

Rep: Reputation: 38
This page explains how photorec works and foremost works the same way, it looks for headers and footers of the filetype you are looking for.
http://www.cgsecurity.org/wiki/Photo...PhotoRec_works

If you can open several sample files in a hex editor and see what is identical at the beginning and end of each file, you can add that information in foremost.conf to search for your filetype.
 
Old 04-03-2010, 10:54 AM   #6
linus72
Guru
 
Registered: Jan 2009
Location: Gordonsville-AKA Mayberry-Virginia
Distribution: PocketWriter/MinimalX
Posts: 5,084

Rep: Reputation: 336Reputation: 336Reputation: 336Reputation: 336
systemrescuecd has everything you need probably including foremost and fsarchiver
and great docs and support
http://www.sysresccd.org/Main_Page

I also included it in thorshammerII
http://linux.softpedia.com/get/Syste...II-55542.shtml
 
Old 04-06-2010, 07:59 AM   #7
ytd
Member
 
Registered: Jan 2009
Posts: 189

Original Poster
Rep: Reputation: 31
Aight, I have recovered some files, but... looks like during the recovery process, the photorec recovery program didn't successfully saved all the data, 'cause I had some *.unl files and the program converted them in to *.txt files. In the *.txt files the information is sometimes truncated and insufficient. My question is now, is there a program that can saves the data (the deleted data with rm -rf command) within a specific path ? (I know exactly where the data was) Or if it is a program that can restore/recover the data and not change the extension ? Keep in mind that I wrote a 70GB archive *( *.tar.gz archive) but in a different path but on the same partition.

tyvm for the info so far, it was good, but looks like I need more.

any advice would be great, any foot shot in my *ss repressents a step forward. :P I'm like... waiting for it. :naughty:
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
recovery of deleted files linux4real Linux - Newbie 7 06-29-2006 09:14 AM
recovery of deleted files linux4real Linux - Software 3 06-27-2006 02:13 PM
recovery of deleted files linux4real Linux - General 1 06-27-2006 10:32 AM
deleted files - reiser JS recovery eponymous Linux - Hardware 0 10-15-2004 04:06 PM
recovery files deleted in Linux Nandex Linux - Software 8 02-14-2004 05:22 PM


All times are GMT -5. The time now is 06:17 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration