LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices

Reply
 
LinkBack Search this Thread
Old 01-18-2006, 03:45 PM   #1
Thorrn4
Member
 
Registered: Mar 2005
Distribution: Mepis 3.3.1
Posts: 36

Rep: Reputation: 15
recoverying deleted data from ext3 partitions


Recently, I deleted my /home files [I used the "rm -rf" command, but Ilinked it wrong to the file and it deleted and the all the files of /home/thorrn4 instead of the folder ], not the whole partition, but the files on it - Music, Photos, etc.

I was wondering: is there a way to recovery some, if not all, my lost data
 
Old 01-18-2006, 04:26 PM   #2
scott_R
Member
 
Registered: Jul 2003
Location: Brighton, Michigan, USA
Distribution: Lots of distros in the past, now Linux Mint
Posts: 746

Rep: Reputation: 31
As far as I know, there isn't a way, as ext3 zeros out the inodes to prevent getting tripped up by false data when rebooting after a bad shutdown. As a result, unlike other filesystems (including ext2), that removes hooks to the deleted data, making recovery nearly impossible. (It can still be done, but it now becomes an art, done by someone with a lot of experience and skill, not something an automated tool is capable of. To give you an idea of the work involved, the following command is a good starting point:

grep /dev/hda1

As you can imagine, you're basically taking all the data off the partition, and hand sorting it, hoping to recover your information. Not really worth it, unless you're extremely adept with a number of complex, low-level forensics tools, or the information is somehow so irreplaceable that you you have no other option. The best you can hope for at this point is that you didn't learn a costly lesson in backups and using the root account as cautiously and rarely as possible.

If you do decide to attempt recovery of the folder, remember that the more you use that partition, the more likely the data will be overwritten an scrambled even more, so the best bet would be to boot into another linux partition, or better, to use knoppix (or a knoppix forensics cd) and run completely off the cdrom, so you don't disturb the partition with the data on it.

Sorry about the bad news, and I hope you didn't lose anything too irreplaceable. At some point we all cross this path, and I know how terrible it can be. To prevent a problem like this in the future, you may want to look into writing a bash-script that prevents you from deleting entire folders in the home, boot, and other important directories, without jumping through a lot of hoops and warnings. It's worth the time and hassle to learn how to do this.
 
Old 01-18-2006, 04:50 PM   #3
scott_R
Member
 
Registered: Jul 2003
Location: Brighton, Michigan, USA
Distribution: Lots of distros in the past, now Linux Mint
Posts: 746

Rep: Reputation: 31
It probably won't help much, but an alternative way of doing the "grep" thing is explained here:

http://www.csummers.org/index.php/20...xt3-partition/
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How to recover a deleted file from ext3 filesystem ? Honor Linux - Software 1 12-21-2005 12:36 PM
ext3 partitions deleted when win xp disc inserted Sweetness Linux - Hardware 1 04-30-2005 07:53 PM
Frontend for recovering deleted files from ext3 filesystem jayakrishnan Linux - General 3 12-16-2004 02:21 PM
Data on Partition deleted rahulnsoni Linux - Newbie 5 05-01-2004 05:58 AM
Recovering deleted data Korff Linux - Software 13 06-23-2003 01:58 AM


All times are GMT -5. The time now is 01:16 PM.

Main Menu
 
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: @linuxquestions
Open Source Consulting | Domain Registration