LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Ubuntu
User Name
Password
Ubuntu This forum is for the discussion of Ubuntu Linux.

Notices

Reply
 
Search this Thread
Old 11-14-2007, 07:53 PM   #1
satimis
Senior Member
 
Registered: Apr 2003
Posts: 3,385

Rep: Reputation: 52
How to restore data on /home/user accidentally removed


Hi folks,



Ubuntu 7.04 server amd64


While I login as "satimis", I accidentally ran "sudo deluser --remove-all-files satimis" removing all data and config files of "satimis". Because login, "satimis" and its home directory /home/satimis are still there after relogin. I'm trying to restore the backup. I never did it before.


googling brought me following thread;
home user backup/restore problem
http://ubuntuforums.org/showthread.php?t=546905

$ apt-cache policy dar
Code:
dar:
  Installed: (none)
  Candidate: 2.3.3-0ubuntu1
  Version table:
     2.3.3-0ubuntu1 0
        500 http://us.archive.ubuntu.com feisty/universe Packages
dar NOT installed. I'll install it later.


Please advise;

1)
Where is /path/my_archive_file? How to find it?

2)
Currently I have some working data on /home/satimis copied from another PC with "scp". Will restore overwrite those working data? If YES, can I move them to another user's home for temporary storage?

3)
Are there better solutions than that mentioned on the above thread?


TIA


B.R.
satimims
 
Old 11-15-2007, 01:48 AM   #2
hoes
Member
 
Registered: Sep 2005
Distribution: debian, linux from scratch
Posts: 89

Rep: Reputation: 20
You removed the home files?
It is unlikely that you will be able to restore the data.
It looks like in the home user back-up, they had a back-up.
If you have a back-up you should restore it.
If not you're kind of screwed.
The thread about the backup restore problem assumes there is a backup and is more about extracting the files.

The data on anotther PC will most likely not be overwritten.
But this depends on how it is set up. If you just copied the files once with scp, no harm will be done overwriting. But since you have a copy you could try putting that back in your home directory.

Also, maybe there is a program that can recover remove linux data from an ext2 of ext3.

Good luck with your problem
 
Old 11-15-2007, 02:28 AM   #3
kWzTa
LQ Newbie
 
Registered: Sep 2005
Distribution: Slackware
Posts: 9

Rep: Reputation: 0
Hello,

I think that by issuing "sudo deluser --remove-all-files satimis" you really deleted your files. If that's the case
"dar" won't be of much help. I do not know the command, but according to the link you gave, it sounds more like a
backup/restore program which means that unless you have a backup/archive, "dar" is useless for your problem.

One way, if you had an ext2 filesystem is to read and follow instructions of the following HOWTO which uses the
command "debugfs" :

http://tldp.org/HOWTO/Ext2fs-Undeletion.html

Basic recovery procedure can be summarized as follows:
1) use debugfs to retrieve a list of deleted inodes
2) select the inodes you wish to recover (most likely based on deletion time)
3) use debugfs to recover selected inodes
4) sort recovered inodes (maybe the most tedious step: once a file is deleted you lose its name !)

The HOWTO targets ext2 filesystem but since "debugfs" supports ext3 also, it may also work with ext3. A similar command also exists for ReiserFS: "debugreiserfs", so something similar might hold for ReiserFS.

There are surely other tools, maybe more user-friendly than this method.

Try again in Google using variations of linux recovery, linux undeletion etc.

In any case make sure you BACKUP FIRST any remaining valuable files.

HTH,
 
Old 11-16-2007, 07:27 AM   #4
satimis
Senior Member
 
Registered: Apr 2003
Posts: 3,385

Original Poster
Rep: Reputation: 52
H kWzTa and hoes,


Thanks for your advice.


The filesystem is ext3.

The building of the mail server has been completed. It is now working. I found spam mails being delivered to satimis' Maildir. I have no way to stop it therefore I deleted this user. Unfortunately I forgot saving the work done in the last 7~10 days. The work are in .txt, .pdf and .jpg files. recording the steps on building the mail server, problem encountered and their solution, etc. Because login as satimis, user can't be removed but all data on its home directory deleted together with some configure files of the mail server.


TestDisk and PhotoRec may help;
http://www.cgsecurity.org/wiki/TestDisk

However it is already 2 days since the incident. Some space on the HD has already been overwritten. It has not much sense to try undeleting those data because the chance of recovery is remote. But I'll try only for learning. However I haven't figured out where to keep the recovered data.

The Recovery Steps on following document;
http://www.shawnhermans.com/how-reco...identally-repa

explains the steps as well as the storage space for recovered data. I hope to build up my knowledge in this respect through learning a bitter lesson.


B.R.
satimis
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Accidentally removed shadow package hussar Slackware 3 12-24-2005 06:31 AM
accidentally removed /dev/cdrom verbose Linux - General 18 10-26-2005 03:44 PM
I accidentally removed the netstat command ! markraem Solaris / OpenSolaris 6 10-03-2005 10:18 AM
newbie - removed partition accidentally kristalchimera Debian 6 07-12-2003 11:36 PM
I accidentally removed lilo from my bootsector. Grafbak Linux - Newbie 2 06-20-2003 03:22 PM


All times are GMT -5. The time now is 04:47 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration