Undelete? Data recovery?

uhcafigdc · 11-19-2008, 10:50 AM

After doing rm on a file in ext3, or shift+delete in Ubuntu, how can I get the file back? After a Google search I am finding a lot of expensive data recovery software, but it isn't worth the money.

pljvaldez · 11-19-2008, 10:56 AM

I found this on google. Never tried it though...

pixellany · 11-19-2008, 11:01 AM

The most commonly recommended tools are photorec and testdisk (both from the same source: http://www.cgsecurity.org/wiki/TestDisk )

pljvaldez · 11-19-2008, 11:03 AM

The only issue with photorec and testdisk (both are great tools for failed systems though where you're just desperate to get anything back) is that you will recover all files of a type and then weed through the results to find what you're looking for. If you have thousands of photos, for example, this can be very labor intensive and disk space intensive.

Junior Hacker · 11-19-2008, 11:10 AM

You could try running command: photorec from a live CD. It is part of the testdisk package but you don't want to install it in the system that you lost the file in, as a matter of fact, you would want to reduce the amount you use the file system containing your lost file as much as possible to avoid overwriting it.
If the file is intact and still there, photorec will recover it. If it is still there but fragmented, you may still be able to recover it but this requires allot of studying and using sleuthkit along with photorec.
Sleuthkit can tell you exactly where the file's inode is.
A forensics live CD will have all these data recovery tools. Try the Helix Live CD.

Junior Hacker · 11-19-2008, 11:29 AM

As root, the example command below should show all deleted files using sleuthkit and their inode # and directory. Although I have not tried it on ext3 file system personally.

Code:

fls -rd /dev/sda1 | less 
    d/d * 232: /TEMP-823450 
    r/d * 293: /TEMP-131100

The “d/d” follows the format of directory entry value type value 
and the second letter is the type according to the inode. The “d” 
stands for directory, and the “r” stands for file. In most instances, 
these should match. However, in the case of deleted files where the inode has been reallocated, it will not. 
The asterisk “*” shows that it is deleted. The number following is the inode number. 
After this is the full path of the deleted files.

If you figure out where your deleted file is, and you know it's size more or less, you can use dd to extract an image of that section of the file system and work on the image to recover the file and continue using the OS. It is advised to make an image of the entire block containing the file in case it is fragmented. It is not usual for a file to be written to more than one block unless it's size exceeds that of the block size.