LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 07-12-2006, 03:01 AM   #1
pwnd
LQ Newbie
 
Registered: Jun 2006
Posts: 18

Rep: Reputation: 0
Setting to a previous date


I accidently deleted a folder with some photos in them which I didn't want to delete. I did this about a day ago or so. I know in windows you can set your computer to a previous date so you can retrieve deleted folders and such. Is there such thing in Linux(Ubuntu)? If not that, than any other way possible to bring my photos back to life?
 
Old 07-12-2006, 03:43 AM   #2
pljvaldez
LQ Guru
 
Registered: Dec 2005
Location: Somewhere on the String
Distribution: Debian Wheezy (x86)
Posts: 6,094

Rep: Reputation: 271Reputation: 271Reputation: 271
I think there are some commercial versions of software that might let you go back and undelete the folder, but I'm not sure.

I personally have had success recovering data off of a drive using the program foremost on linux. But you can't be running an OS from that partition to recover data from it. For example, I unplugged the drive and made it a slave on my debian box. I was pretty impressed with what it came back with. Just be ready to weed through all the data when it's done. Some of the photos will be ruined, but most of mine were salvageable...
 
Old 07-12-2006, 03:44 AM   #3
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
The date wouldn't have any impact on it... if you're using ext2
as your file-system and you didn't write any new stuff to the
hdd since you may be lucky, fire up midnight commander (type mc)
and look through the menu. In all other cases you're pretty much
on your own; there's a few forensic tools that try to recover
certain file-types from the raw-device, but it's not a laymans
thing, I don't think.


Cheers,
Tink


P.S.: I'm not windows expert by any means, but I think that you got
the date thing wrong ;}
 
Old 07-12-2006, 10:19 PM   #4
pwnd
LQ Newbie
 
Registered: Jun 2006
Posts: 18

Original Poster
Rep: Reputation: 0
I appreciate the help but neither of these worked . Is these ANY other way I can retrieve the photos. They were really good!
 
Old 07-13-2006, 12:20 AM   #5
AwesomeMachine
Senior Member
 
Registered: Jan 2005
Location: USA and Italy
Distribution: Debian testing/sid; OpenSuSE; Fedora
Posts: 1,923

Rep: Reputation: 278Reputation: 278Reputation: 278
Jpeg files have a signature, which is the first four bytes of the file:

ff d8 ff e0 hex

You can search for this value with:

dd if=/dev/sda | hexdump -C | grep ff d8 ff e0

Wherever you get a hit is where a jpg file starts. Over on the left of the output are hex offsets. That is the exact byte on the disk where the line begins. You convert the byte offset where you find the the signature bytes to decimal with one of the many calculators in linux. Then, say you located ff d8 ff e0 at offset 000 0ac 000 0. That's decimal offset 11,272,192. If you divide that by 512 bytes per sector you get 22,016. So, to get to that file:

dd if=/dev/sda count=22,016 bs=512 | hexdump -C | less

Now, the first bytes on the screen should be ff d8 ff e0. That is the beginning of a jpeg. Jpegs end with ff d9. So, using pgup, pgdn, arrows, navigate to where you see a a bunch of lines of zeros. Right before the zeros start, you will see ff d9. d9 is the end of the jpg file. Make note of that offset. That is the file length in hex. Convert it to decimal with a calculator. Say it's 8000 hex long. That's 32,768 decimal.

dd if=/dev/sda skip=11272192 count=32768 bs=1 > /directoryonadifferentdrive/filename.jpg
 
Old 07-13-2006, 04:12 AM   #6
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
You could try the following tools ...

http://www.vanheusden.com/recoverdm/

http://jbj.rapanden.dk/magicrescue/



Cheers,
Tink
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Setting date namit Linux - Newbie 3 04-04-2006 12:02 AM
setting time and date? maginotjr Slackware 7 06-28-2005 09:53 AM
date command getting previous day swinchen Programming 6 08-23-2004 01:17 PM
setting date and time lynger Linux - Software 2 05-21-2004 01:10 AM
setting the date Nyc0n Linux - General 2 05-24-2002 03:56 AM


All times are GMT -5. The time now is 08:43 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration