Hello everyone,

I disperately need to recover some folders and some files from my CentOS 5.3 X86_64 linux machine ext3 partition after I have deteled them with rm -rf command.

After I have deleted the files (*.exp extension) and folders with rm -rf command, I have written a big archive 70GB on the same partitions but in a different path. I know that in windows if I do that, there's no way I can bring back the deleted files, 'cause the OS writes the information in the same cluster and therefor I can't bring back the files. I hope you guys understand what am I saying.

My question is, what program (that knows all extensions, or dosen't read a specific extension/extensions) can I use in order to get the date back ? I have used foremost and it worked, but this programs knows only specific extensions, like exe, jpg, avi, mpeg, etc and not my *.exp extension. The foremost program worked perfectly, but it dosen't know the *.exp extension that I need, in order to get the data back that has that extension.

I'm sorry for my english, but it's not my 1st language, and I don't write well.

Thank you in advance and I hope I will get a fast and a good answer. I need this kind of info urgent.

You can use foremost to recover any file type, you just have to do a little homework first. Specifically you will need to know the file header and footer hex code and then you can add it to foremost.conf.
You could probably copy a sample file to a flash drive and examine it to get that info, or it may be available on the web somewhere.

You will still run into the same issue of the blocks being over written by the newer data though.

If you have recovered a large number of files but not the file names w/extensions you can use the `file' command to determine what type a file is.

frndrfoe:

header and footer hex code ? wtf is that ? I only know the extension, if you reffer to that. Give me an example pls. My files extensions that were in folders(directoryes) had extension with *.exp
What should I write and where should I write in foremost.conf in order to get the data back ?
I can obtain the header and footer hex code if I copy an example of that data (I do have an example) by copying the example of data to a flash memory how ? Can you be more specific pls ?

jschiwal:

I didn't recover nothing, 'cause the foremost program recover only known extensions, avi, mpeg, blalvlabv and the directory of the deleted files contains only .*.exp extensions

Pls, what command should I use and what and where in the foremost.conf I need to write to get data back ?

I don't have time ,my time is 100% ocupied, can'd do tests.

This page explains how photorec works and foremost works the same way, it looks for headers and footers of the filetype you are looking for.
http://www.cgsecurity.org/wiki/Photo...PhotoRec_works

If you can open several sample files in a hex editor and see what is identical at the beginning and end of each file, you can add that information in foremost.conf to search for your filetype.

systemrescuecd has everything you need probably including foremost and fsarchiver
and great docs and support
http://www.sysresccd.org/Main_Page

I also included it in thorshammerII
http://linux.softpedia.com/get/Syste...II-55542.shtml

Aight, I have recovered some files, but... looks like during the recovery process, the photorec recovery program didn't successfully saved all the data, 'cause I had some *.unl files and the program converted them in to *.txt files. In the *.txt files the information is sometimes truncated and insufficient. My question is now, is there a program that can saves the data (the deleted data with rm -rf command) within a specific path ? (I know exactly where the data was) Or if it is a program that can restore/recover the data and not change the extension ? Keep in mind that I wrote a 70GB archive *( *.tar.gz archive) but in a different path but on the same partition.

tyvm for the info so far, it was good, but looks like I need more.

any advice would be great, any foot shot in my *ss repressents a step forward. :P I'm like... waiting for it. :naughty: