Hi,

Not too sure if this is the correct forum, and please let me know if that is the case.

I need help recovering files that I cut and not deleted.

I cut and pasted folders to a cd, which never got written. I repasted the folders back in the original directory when I realized they were missing and now the folders are back in the original directory except they are empty. Even the sub folders are there, but these are empty too. All the files are missing.

This happened yesterday morning. I'm not a linux expert, and am not sure how that works. But the laptop has been restarted.

I have fedora14.


Thanks

Orange Oats

By cutting the system makes a copy of an item and removes the original when the item gets pasted at its destination. The trick is that (free after Orwell) one could say that all destinations are treated equal but some are more equal than others... For instance writing a CDROM or DVDROM may include creating a temporary image (unless on-the-fly or UDF packet writing is enabled?) which is written to hard disk and removed after the image is burnt. So the result of the final stage of the operation (writing to .*ROM) may (or likely may not) be checked by the initial cut operation. So in essence when you pasted the item and started the writing operation you caused the items to be deleted.


Deletion is more or less permanent and almost always irrecoverable with current journaling file systems. The best thing to do is to shut down the machine without graceful shutdown (deny the file system to sync) immediately after the accident, not boot it again unless using a Live CD that mounts the partitions in read-only mode (mount -o ro,norecovery,noload) and read and ask for help before doing things.

The easiest way to find out if recovery can do something for you would be to boot a Live CD like Helix (MD5 hash 93a285bfa8ab93d664d508e5b12446d3) or KNOPPIX, attach external storage and use Photorec to see if it can recover files to your external disk. This however poses some problems as you must download the ISO and burn it on another system (safeguarding against further deterioration of the "victim" system) and actually have external storage big enough to recover all files to. Regardless of the conjunction of certain stars or effort put in for purely technical reasons the result may or may not not be satisfactory and recovery may contain usable files, partial files and complete garbage. (So unfortunately if the items were of indispensable value then you now know why making proper backups is important.)


Good luck and if you have any questions before starting now would be a good time.

Hi,

Thank you for the reply, it leads to one other question. I never burned the cd, because these missing files were listed as unrecognised, where it usually says the file type, on it, so it seems I may be in luck. I will look this up, but would like to take the opportunity to ask how I go about getting them then to ensure I do it correctly, and not loose them.

Thanks,

OrangeOats

I can't support that interpretation nor your optimism...


Hmm. Probably chalk it up to me using too much words but what I've tried to convey is that chances are slim that you will recover any files in a usable state due to 0) not halting the OS right after the deletion and 1) the way a modern file system works. Here's how:
- Use another system to download and burn the HELIX ISO. Boot it in that machine to see if it works OK.
- If the "victim" machine is a desktop you could open it and add another hard disk if you have one, else attach an external (USB, Firewire?) hard disk.
* If the "victim" machine is a laptop ensure it is on working adapter power. A battery won't cut it.
- Boot your "victim" system with the HELIX CDROM and be in a console or open a Konsole or Xterm window.
* If you need to format the spare internal or external hard disk use 'fdisk -l' to get a list of attached storage devices. Internal disks may be of type hd or sd but external drives usually are of type sd (SCSI emulation). If the spare internal or external hard disk for instance has the name "/dev/sdb" (pick the drive by its size or confirm by running 'hdparm -i /dev/sdb' on it) continue else run 'fdisk -l', halt here and post the output before continuing.
- Now run 'dd if=/dev/null of=/dev/sdb bs=1M count=1' to nuke slightly more than the MBR and partition table, run 'fdisk /dev/sdb', press "o", press "n", and accept all values, press "t" and use value "83", press "w". Now run 'mkfs.ext2 -L RECOVERY /dev/sdb1' and wait for it to finish. You now should have a spare disk with one single partition labeled "RECOVERY" spanning the whole disk. Confirm by runing 'fdisk -l /dev/sdb'. (Of course you may chose to use the other system and a GUI tool to prep the disk.)
- Run 'mkdir /RECOVERY; mount /dev/disk/by-label/RECOVERY /RECOVERY' to mount the external drives partition.
- Run 'cd /RECOVERY; photorec /log /debug /d /RECOVERY /dev/sda'. Select the right disk then select "proceed", select "Intel". Select "File Opt", press "s". Scroll down and select ISO (space bar) and select "b" then "OK" and press "q". Select the partition the ISO may have resided on if it is a separate partition (/tmp, /var and /home being good choices to start with) else select "Whole disk". Select "ext2/ext3", select "free" and let it work. Depending on the disk size this may take minutes to hours to dates.
- When finished run 'umount /RECOVERY' and power down the machine.
* Use the other system to mount and inspect the spare drives contents.

1 members found this post helpful.

The "victim", an interesting choice of words. You seem to be misdirected as to who the REAL VICTIM is here. Who has ultimately lost files at the hands of bullies, bullying me in the name of my sister. You've been bullying me in her name for ages now, starting on her birthday last year, when you told me on a website out of the blue how homely and manly looking I am compared to her, and how horrible my legs and cheekbones are compared to hers.

You have just destroyed my files on purpose to screw me over on purpose in the name of my sister, because I gave my mother a Knoppix CD for my sister's laptop, and didn't tell my mother it had a graphical interface. Instead I told her it had a "console".

I knew this stunk. The TIMING STUNK. Low and behold I loose work files 5 minutes before I submit them less than 24 hours after I gave my mother that Knoppix CD. I KNEW IT. I knew this was related. You are real bastards. I stayed up all night, literally, to get everything done on time, and then you TOTALLY SCREWED ME OVER as I was going to hand it in. What was going to be a good impression instead resulted in a guarantee that I would never get any more work from them.

You screwed me at the phone support job I had in the name of my sister too. After I LOST THAT JOB DUE TO YOU. It was non stop harassment using my sister as a weapon. It was all HAH, not only are you uglier than your sister but you are an antisocial loser too. You just got sacked from your job, because you are socially inept unlike your perfect sister. Hah, see the evidence??? you just got sacked, see the evidence????

YOU ARE EVIL.

0 members found this post helpful.

WTF????? Reported

FWIW, I have added a "Helix (live cd)" entry to the Wikipedia® here:
http://en.wikipedia.org/wiki/Helix_(...ion)#Computing

It can be found on DistroWatch here & here.

I am not clear whether it's based on Knoppix, Ubuntu, or both.

1 members found this post helpful.

Agreed...WTF is exactly right. Wow.