Linux - NewbieThis Linux forum is for members that are new to Linux.
Just starting out and have a question?
If it is not in the man pages or the how-to's this is the place!
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
I accidently deleted a folder with some photos in them which I didn't want to delete. I did this about a day ago or so. I know in windows you can set your computer to a previous date so you can retrieve deleted folders and such. Is there such thing in Linux(Ubuntu)? If not that, than any other way possible to bring my photos back to life?
I think there are some commercial versions of software that might let you go back and undelete the folder, but I'm not sure.
I personally have had success recovering data off of a drive using the program foremost on linux. But you can't be running an OS from that partition to recover data from it. For example, I unplugged the drive and made it a slave on my debian box. I was pretty impressed with what it came back with. Just be ready to weed through all the data when it's done. Some of the photos will be ruined, but most of mine were salvageable...
The date wouldn't have any impact on it... if you're using ext2
as your file-system and you didn't write any new stuff to the
hdd since you may be lucky, fire up midnight commander (type mc)
and look through the menu. In all other cases you're pretty much
on your own; there's a few forensic tools that try to recover
certain file-types from the raw-device, but it's not a laymans
thing, I don't think.
Cheers,
Tink
P.S.: I'm not windows expert by any means, but I think that you got
the date thing wrong ;}
Distribution: Debian testing/sid; OpenSuSE; Fedora; Mint
Posts: 5,524
Rep:
Jpeg files have a signature, which is the first four bytes of the file:
ff d8 ff e0 hex
You can search for this value with:
dd if=/dev/sda | hexdump -C | grep ff d8 ff e0
Wherever you get a hit is where a jpg file starts. Over on the left of the output are hex offsets. That is the exact byte on the disk where the line begins. You convert the byte offset where you find the the signature bytes to decimal with one of the many calculators in linux. Then, say you located ff d8 ff e0 at offset 000 0ac 000 0. That's decimal offset 11,272,192. If you divide that by 512 bytes per sector you get 22,016. So, to get to that file:
dd if=/dev/sda count=22,016 bs=512 | hexdump -C | less
Now, the first bytes on the screen should be ff d8 ff e0. That is the beginning of a jpeg. Jpegs end with ff d9. So, using pgup, pgdn, arrows, navigate to where you see a a bunch of lines of zeros. Right before the zeros start, you will see ff d9. d9 is the end of the jpg file. Make note of that offset. That is the file length in hex. Convert it to decimal with a calculator. Say it's 8000 hex long. That's 32,768 decimal.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.