LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Software (https://www.linuxquestions.org/questions/linux-software-2/)
-   -   How to recovery files with original names? (https://www.linuxquestions.org/questions/linux-software-2/how-to-recovery-files-with-original-names-4175445970/)

inkscape 01-17-2013 12:59 AM

How to recovery files with original names?
 
I use
Code:

rm -fr *.mp4
in wrong directory, so I need recovery files. Directory is in my home partition.
So, It's possibility recovery with original names or last names?

chrism01 01-17-2013 01:06 AM

Try the photorec or Testdisk utilities, but you should stop using the system asap, as it may overwrite the 'deleted' files.

If the system was using a GUI and has a Trash icon, you may find the files in there, without using the utilities.

inkscape 01-17-2013 02:05 AM

What is asap system?
I haven't files in trash.

I use photorec but it hasn't output original names. ;(
(only fnumber.mp4 ....)

I care about restoring .mp4 files before 48 hours with original names.

colucix 01-17-2013 02:12 AM

FYI, ASAP = As Soon As Possible
FYI = For Your Information
;)

syg00 01-17-2013 02:48 AM

Quote:

Originally Posted by inkscape (Post 4871956)
I care about restoring .mp4 files before 48 hours with original names.

In which case you should simply restore them from your backup.

inkscape 01-17-2013 03:10 AM

I haven't backup.
I modified some parameters (sync audio, codec etc) and I haven't finished work.
I don't want start from scratch and lost effect.

So, I haven't chance to restore files from a specific directory, last modification time?

TobiSGD 01-17-2013 05:27 AM

You may have a chance with using ext3undelete. But if you have used the system since you deleted the file chances are high that the files are already overwritten, so unrecoverable.
The most important principle of data recovery is not allowing any writes to the partition where the files are on.

inkscape 01-17-2013 07:34 AM

I read opitions extundelete. This command:
Code:

extundelete /dev/sda3 --restore-directory ~/Wideo/ --after 1358323320
will be ok?

TobiSGD 01-17-2013 07:37 AM

Never tried it and don't have it installed on my systems, so I can't say.

Are you still using the OS which you used to delete those files?

unSpawn 01-17-2013 07:37 AM

...additionally a single file gets a single inode assigned.
This inode holds, among other things, information like the file name.
If the link between inode and file is broken that information is lost.

inkscape 01-17-2013 08:12 AM

Quote:

Originally Posted by TobiSGD
Are you still using the OS which you used to delete those files?

I turn off machine yesterday. But I try my command (first umount sda3):
Code:

#extundelete /dev/sda3 --restore-directory /home/user/Wideo/lost --after 1358323320
Only show and process deleted entries if they are deleted on or after 1358323320 and before 2147483647.

WARNING: Extended attributes are not restored.
Loading filesystem metadata ... 1745 groups loaded.
Loading journal descriptors ... 29855 descriptors loaded.
Failed to restore file /home/user/Wideo/lost
Could not find correct inode number past inode 1835010


rknichols 01-17-2013 02:02 PM

Quote:

Originally Posted by unSpawn (Post 4872138)
...additionally a single file gets a single inode assigned.
This inode holds, among other things, information like the file name.
If the link between inode and file is broken that information is lost.

The inode does not contain the file name. Only the directory entry contains the name, and that is lost when the file is unlinked by the rm command.

rknichols 01-17-2013 03:50 PM

What you might be able to do is use debugfs to dump the data blocks for that directory and then examine the output with a hex editor. That should help you remap the photorec filenumbers to their original names. Beware that the directory may contain entries for older versions of files, and anything you've done in that directory may have overwritten some of what you need, so it's going to take some work to sort it out.
Code:

# debugfs /dev/sda3
debugfs: dump home/user/Wideo /var/tmp/dirdata
debugfs: quit
#

In /var/tmp/dirdata you'll see filenames in text, each preceded by some binary data including the inode number (little-endian). At least that's the case for ext2 and ext3. I haven't had occasion to look at the on-disk directory format variants for ext4. With a little luck and a lot of effort you may be able to restore the original names for most of those deleted files.


All times are GMT -5. The time now is 05:29 PM.