LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 02-04-2009, 04:38 AM   #1
muditcse@yahoo.com
LQ Newbie
 
Registered: Mar 2008
Posts: 22

Rep: Reputation: 15
how to recover deleted data??


HI,

I have deleted a very important data from my linux OS.Is there any way of recovering the data???
 
Old 02-04-2009, 04:56 AM   #2
eco
Member
 
Registered: May 2006
Location: BE
Distribution: Debian/Gentoo
Posts: 412

Rep: Reputation: 48
Most will probably say, recover from your backup.

If you can it will be tough. First of all, you need to stop witting to the disk as each write could overwrite the file(s) you want to restore.

Then you need to give us more information.

- What filesystem?
- What is the data you need to recover (file, files, small, large)?

I'd probably clone the disk to an image and work from a copy of the image. That way, you're system is back up and you can take your time and try out several possibilities.

I managed to recover small files from ext3 but it was not easy. I never managed to recover large ones.

Best of luck.
 
Old 02-04-2009, 05:01 AM   #3
linuxlover.chaitanya
Senior Member
 
Registered: Apr 2008
Location: Nagpur, India
Distribution: Cent OS 5/6, Ubuntu Server 10.04
Posts: 4,629

Rep: Reputation: Disabled
If data was important, how did you delete in first place?
Also it would be helpful if you could give more information. You did not say how did you delete it? You do not say what OS and FS it is. And did you overwrite it in some way?
 
Old 02-04-2009, 07:50 AM   #4
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 671Reputation: 671Reputation: 671Reputation: 671Reputation: 671Reputation: 671
If it is very important, then make an image of the partition before preceding. You don't want the data being overwritten.

One program that can recover files is photorec.

Also there is the "debugfs" command that can undelete an inode. You can run "debugfs /dev/sd##" as root, enter "cd /dir/path/" and then "lsdel" to list deleted files. Then "undel <inode> filename" where inode is the inode number. You need the angle brackets for this command.

e.g.
undel <110123> /data/filename

This assumes that debugfs can find it. This command is for ext2/3 filesystems.

If you know what kind of file it is or some of the contents, you could try hunting for it on an image of the filesystem and try to cut it out using dd.

There may also be an undelete command. Check sourceforge.

---

Working from a live cd may be a good idea instead of keeping your system live.

Last edited by jschiwal; 02-05-2009 at 06:53 AM. Reason: typo fix
 
Old 02-04-2009, 08:02 AM   #5
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Arch/XFCE
Posts: 17,802

Rep: Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738
Often recommended is "testdisk" (Same author as photorec---which was mentioned above) I have successfully used photorec, but not testdisk.

Ditto the comments about not writing to the drive.
 
Old 02-05-2009, 06:44 AM   #6
muditcse@yahoo.com
LQ Newbie
 
Registered: Mar 2008
Posts: 22

Original Poster
Rep: Reputation: 15
my FS in ext2 and OS is RHEL4...i already tried debugfs....deleted with rm -rf....
 
Old 02-05-2009, 08:52 AM   #7
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Arch/XFCE
Posts: 17,802

Rep: Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738
Quote:
Originally Posted by muditcse@yahoo.com View Post
my FS in ext2 and OS is RHEL4...i already tried debugfs....deleted with rm -rf....
You have not responded to all of the advice given so far......if you don't try what we suggest, then we can't be much help to you.

I'll add one more tip: If the data is really valuable, and you are uncomfortable with learning about file recovery, then get the drive to a professional recovery service.

Last edited by pixellany; 02-05-2009 at 08:54 AM.
 
Old 02-05-2009, 09:14 AM   #8
your_shadow03
Senior Member
 
Registered: Jun 2008
Location: Germany
Distribution: Slackware
Posts: 1,461
Blog Entries: 6

Rep: Reputation: 51
Photorec - I assure is the Best Option.
You will surely get it back..Its Powerful...
 
Old 02-06-2009, 12:24 AM   #9
linuxlover.chaitanya
Senior Member
 
Registered: Apr 2008
Location: Nagpur, India
Distribution: Cent OS 5/6, Ubuntu Server 10.04
Posts: 4,629

Rep: Reputation: Disabled
Quote:
Originally Posted by muditcse@yahoo.com View Post
my FS in ext2 and OS is RHEL4...i already tried debugfs....deleted with rm -rf....
I very good example why -rf option should be used very carefully with rm.
 
Old 03-09-2009, 11:21 PM   #10
pcardout
Member
 
Registered: Jun 2003
Location: Socorro, New Mexico
Distribution: Debian ("lenny", "squeeze"), Linux Mint, XUbuntu
Posts: 218

Rep: Reputation: 24
Jschiwals advice is really nice.

It is quite cool to see what debugfs can do.

Am in middle of trying to recover a file automatically
deleted from the /tmp directory (my son -- who didn't
understand till now, not to be working in the /tmp directory)

Given /ext3 file system, I just get
Code:
0 deleted inodes found
.
As I've read elsewhere, if you delete in ext3 with rm, or
your OS deletes for you, then you haven't got inodes to work with.

I tried to grep the whole file-system as follows

Code:
grep -a -i potter /dev/sda2
To find any occurence of Potter from Harry Potter on my /home partition.
If you are root -- this can be done but turns out non-productive. It seems for most of
the search strings I came up with that this just spits out lots and lots of gibberish.
Sometimes you can tell why the lines matched, other times they are a few thousand characters long
and the target doesn't even seem to appear on screen.

Further -- I was really trying to find the contents of an .odt file, and those, of course,
are in some encoded binary format, so grepping for readable text does not work. If only
one identified in advance the file to be lost and saved it as ordinary text -- it would be better (grin).

Last edited by pcardout; 03-10-2009 at 01:23 AM. Reason: Update w/ new info.
 
  


Reply

Tags
data recovery


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Recover data which was deleted- Linux linuxguy08 Linux - Server 2 09-10-2008 08:37 PM
how to recover home data, got deleted with the profile manishgarg21 Linux - Newbie 5 05-28-2008 08:16 AM
Reiserfsck stops when rebuilding tree at 50% - trying to recover deleted data vangelis Linux - Software 6 10-23-2006 01:34 PM
need to recover data in a deleted inode wilsonsamm Linux - General 6 08-30-2006 12:34 PM
Software to help me recover 'Deleted' FAT32 Partition Data? flamesrock Linux - Software 8 07-26-2005 11:39 PM


All times are GMT -5. The time now is 01:46 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration