LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 11-05-2011, 03:43 PM   #1
fri
LQ Newbie
 
Registered: Nov 2011
Posts: 6

Rep: Reputation: Disabled
file deleted HELP PLEASE


Dear all,

I'm sorry if I sound very stressed but... I REALLY AM!!! I just deleted part of the picture collection of my father and he is going to kill me.
So the problem is this one:
i gave him my laptop with fedora 15
he had all his pics on an external hard drive
he tried to copy the pics on the pc hard drive, but the temporary memory got full
(sda2, directories /tmp e /var/tmp)
so I thought to delete the files he had already transferred on the pc (in the dir /user/pictures)
/tmp and /var/tmp emptied as well
but then with horror I realized that they were also gone from the external hard disk!
HOW IS THIS POSSIBLE???
HOW CAN I UNDO THIS CATASTROPHE?

PLEASE HELP!
F
 
Old 11-05-2011, 03:57 PM   #2
arizonagroovejet
Senior Member
 
Registered: Jun 2005
Location: England
Distribution: openSUSE, Fedora, CentOS
Posts: 1,078

Rep: Reputation: 195Reputation: 195
If they're gone from the external harddrive then it sounds like he wasn't copying the photos, he was moving them.

I don't understand the stuff you say about 'temporary memory'. If you're just copying/moving files /tmp and /var/tmp shouldn't come in to it.

The good news is that deleting files doesn't remove them from the disk, it just removes the references that say where the file is on the disk and effectively marks that part of the disk as being empty so it can be re-used.

First thing you need to do is to do as little as possible with the laptop. The more thing you do the more the chances of the parts of the harddisk where the files are being over written.

Some stuff here might be useful.
https://help.ubuntu.com/community/DataRecovery

I used recently used http://www.sleuthkit.org/autopsy/desc.php to recover a bunch of files from a dodgy disk. (Edit: Actually I might have used ddrescure. I can't remember for sure. Edit #2. It was Photorec I used. Seeing it mentioned in John VV's post reminded me and I found the remnants of using it on my disk. It worked very well. The files cam back without the original names but that's inevitable.)

What filesystem is the external harddrive formatted with?

Last edited by arizonagroovejet; 11-05-2011 at 04:10 PM.
 
Old 11-05-2011, 04:04 PM   #3
John VV
LQ Muse
 
Registered: Aug 2005
Location: A2 area Mi.
Posts: 16,825

Rep: Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408Reputation: 2408
do you have a copy of "SystemRescueCd"
http://www.sysresccd.org/Main_Page

on a DIFFERENT machine than the one with the missing photos

(turn that one off and DO NO TOUCH IT !!!!!!
you should have turned it off the VERY SECOND you noticed the problem )

download and burn it

then boot into "SystemRescueCd" and use the tool "PhotoRec"
http://www.sysresccd.org/System-tools#PhotoRec

but do some research into using it
http://www.cgsecurity.org/wiki/PhotoRec

Last edited by John VV; 11-05-2011 at 04:06 PM.
 
Old 11-05-2011, 04:11 PM   #4
fri
LQ Newbie
 
Registered: Nov 2011
Posts: 6

Original Poster
Rep: Reputation: Disabled
Hi arizonagroovejet, thanks a lot for your reply. I sincerely don't know what he was doing. Hi just said he was trying to transfer his pics from the HD to the pc. Probably he was moving them, as you said. I don't know why /tmp and /var/tmp were full (99-100%), but they dropped at 15% as soon as I deleted those pics (curse on me!). Luckily I did nothing since then with the laptop except going around looking for the missing files.
The hard disk is vfat.

I'm going to try that website you suggested although it is for ubuntu and I have fedora. Another problem is that I'm not physically at the computer but I'm working on it using TeamViewer.
 
Old 11-05-2011, 04:15 PM   #5
fri
LQ Newbie
 
Registered: Nov 2011
Posts: 6

Original Poster
Rep: Reputation: Disabled
Hi John VV

no, I don't have a copy of "SystemRescueCd".
I didn't turn it off because I was scared even to do that. But I did nothing with the pc since then
 
Old 11-05-2011, 04:20 PM   #6
fri
LQ Newbie
 
Registered: Nov 2011
Posts: 6

Original Poster
Rep: Reputation: Disabled
So is it safe to turn pc and hard disk off and wait until I find a good way to do the recovery?
 
Old 11-05-2011, 04:26 PM   #7
TobiSGD
Moderator
 
Registered: Dec 2009
Location: Germany
Distribution: Whatever fits the task best
Posts: 17,130
Blog Entries: 2

Rep: Reputation: 4825Reputation: 4825Reputation: 4825Reputation: 4825Reputation: 4825Reputation: 4825Reputation: 4825Reputation: 4825Reputation: 4825Reputation: 4825Reputation: 4825
1. Disconnect the external disk and turn it off, it is safe to do that.
2. Install testdisk to the Fedora install.
3. Connect the external disk and turn it on.
4. Use the photorec program (part of the testdisk package) to search for the missing images on the free space of the external disk.
5. Take yourself a lot of time and go through the recovered files to identify the missing images.
6. Explain to your father how important a good backup plan is.
 
Old 11-05-2011, 04:38 PM   #8
fri
LQ Newbie
 
Registered: Nov 2011
Posts: 6

Original Poster
Rep: Reputation: Disabled
6. Explain to your father how important a good backup plan is.

Thank you... you made me laugh and you have no idea of how much I needed it! I will... but now I have to phone him and just tell what happened... sic...
 
Old 11-05-2011, 04:41 PM   #9
sgosnell
Senior Member
 
Registered: Jan 2008
Location: Baja Oklahoma
Distribution: Debian
Posts: 1,054

Rep: Reputation: 276Reputation: 276Reputation: 276
Have you looked in the trash? Deleting files normally just moves them to the trash, and that should also work on external drives. Open your file manager and check the trash. If they're there, just restore them. If not, then proceed as advised above.
 
Old 11-05-2011, 04:46 PM   #10
fri
LQ Newbie
 
Registered: Nov 2011
Posts: 6

Original Poster
Rep: Reputation: Disabled
Thanks sgosnell

but that was the very first thing I did. I was horrified when I discover they were not there...
 
Old 11-05-2011, 10:27 PM   #11
frankbell
LQ Guru
 
Registered: Jan 2006
Location: Virginia, USA
Distribution: Slackware, Debian, Mint, OpenBSD
Posts: 11,352
Blog Entries: 12

Rep: Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731Reputation: 2731
I have heard good things about this, but I've never had to use it:

http://www.cgsecurity.org/wiki/PhotoRec
 
Old 11-06-2011, 03:26 AM   #12
themanwhowas
Member
 
Registered: Nov 2005
Distribution: CentOS 5, Fedora 23
Posts: 216

Rep: Reputation: 29
It may be old, but I've used foremost many times for recovering peoples files.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How to recover a deleted file using the ext3 file system wdhpr Linux - Newbie 6 01-11-2011 11:04 PM
[SOLVED] Getting a deleted file Ajit Gunge Linux - Newbie 10 01-06-2011 01:37 AM
Deleted log file - how to get back via file descriptor and keep alive? prollocks Linux - General 1 05-29-2009 10:08 AM
Need help to recover Deleted file - (file was saved in doc) Pravab Ubuntu 2 08-17-2008 11:57 AM
Deleted file klmn1 Linux - Software 2 12-12-2003 07:04 AM


All times are GMT -5. The time now is 08:20 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration