LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 02-12-2007, 08:26 PM   #1
romeo_tango
Member
 
Registered: Nov 2006
Distribution: Mint
Posts: 148

Rep: Reputation: 15
Unhappy Recovering Deleted Files In Samba - Is it possible?


Yesterday, I was copying a file to my shared folder in CentOS and accessed it via WinXP in another box. My bad, i was using [CTRL + X] and directly paste it into my UFD in the Win box. The folder than disappeared in the CentOS machine, and yes it is cut unto my UFD.

Minutes later, when I check it on my other computer, the folder that I cut earlier is empty. *sigh*

I shouldn't cut it in anyway i guess. But the question is, can I recovered the files in the CentOS box? how should I do it since I didn't smell any trace that the Samba Server made of the missing files..

Any help will be appreciated.. Thanks.
 
Old 02-12-2007, 08:36 PM   #2
MS3FGX
LQ Guru
 
Registered: Jan 2004
Location: NJ, USA
Distribution: Slackware, Debian
Posts: 5,852

Rep: Reputation: 357Reputation: 357Reputation: 357Reputation: 357
This is no longer a Samba issue. The file was deleted from the local file system, so you need to look into file recovery for whatever file system that is (EXT3, Reiser, etc).

Depending on which file system you are using, recovery may or may not be possible. If you continued to use the machine for awhile after the file was deleted, then there is a good chance it is already overwritten. If you are serious about getting it back, you need to shut down the server ASAP, and look into what you are going to need for recovery.
 
Old 02-12-2007, 08:41 PM   #3
romeo_tango
Member
 
Registered: Nov 2006
Distribution: Mint
Posts: 148

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by MS3FGX
This is no longer a Samba issue. The file was deleted from the local file system, so you need to look into file recovery for whatever file system that is (EXT3, Reiser, etc).
i'm sorry if there is a misunderstanding but, i was deleting the files from the shared folder (samba server), does it means the file is actually deleted in the CentOS box locally?

Quote:
Originally Posted by MS3FGX
Depending on which file system you are using, recovery may or may not be possible. If you continued to use the machine for awhile after the file was deleted, then there is a good chance it is already overwritten. If you are serious about getting it back, you need to shut down the server ASAP, and look into what you are going to need for recovery.
i see. i'll give it a try since the pc is still powered on after a 12 hours the files deleted. Is there any recommended tools for finding the missing files in CentOS?

Thanks.
 
Old 11-27-2007, 06:25 PM   #4
tbeehler
Member
 
Registered: Aug 2003
Location: Washington State, USA
Distribution: Mainly RH 9.0
Posts: 227

Rep: Reputation: 30
Quote:
Originally Posted by romeo_tango View Post
i'm sorry if there is a misunderstanding but, i was deleting the files from the shared folder (samba server), does it means the file is actually deleted in the CentOS box locally?



i see. i'll give it a try since the pc is still powered on after a 12 hours the files deleted. Is there any recommended tools for finding the missing files in CentOS?

Thanks.

I know this won't help now, but for future reference, there's a stackable VFS module in Samba called "recycle". It's very similar to the Recycle Bin in Windows. Check the documentation on it for more info. I have set it up on my server and it works WONDERFULLY!
 
Old 11-27-2007, 08:58 PM   #5
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 678Reputation: 678Reputation: 678Reputation: 678Reputation: 678Reputation: 678
You might get lucky if something still has a handle on a file. Using lsof | grep '<filename>' see if there is a process that has a lock on the file. If so, cd to /proc/<pid>/ and use "file" to examine the symbolic links in /proc/<pid>/fd/.
Example:
Code:
 ls twim_074_m64.mp3
twim_074_m64.mp3
jschiwal@hpamd64:~> rm twim_074_m64.mp3
jschiwal@hpamd64:~> lsof | grep twim
xmms      30548   jschiwal    9r      REG                8,6 32191841   7027623
/home/jschiwal/twim_074_m64.mp3 (deleted)
jschiwal@hpamd64:~> cd /proc/30548
jschiwal@hpamd64:/proc/30548> ls
attr        cpuset   fd        mem         oom_adj    smaps   task
auxv        cwd      fdinfo    mounts      oom_score  stat    wchan
clear_refs  environ  loginuid  mountstats  root       statm
cmdline     exe      maps      numa_maps   seccomp    status
jschiwal@hpamd64:/proc/30548> ls fd
0  1  10  11  2  3  4  5  6  7  8  9
jschiwal@hpamd64:/proc/30548> file fd/0
fd/0: symbolic link to `/dev/pts/1'
jschiwal@hpamd64:/proc/30548> file fd/1
fd/1: symbolic link to `/dev/pts/1'
jschiwal@hpamd64:/proc/30548> file fd/2

 ...

fd/8: symbolic link to `/dev/snd/controlC0'
jschiwal@hpamd64:/proc/30548> file fd/9
fd/9: broken symbolic link to `/home/jschiwal/twim_074_m64.mp3 (deleted)'
jschiwal@hpamd64:/proc/30548> cp fd/9 ~/twim_074_m64.mp3.recovered
jschiwal@hpamd64:/proc/30548> file ~/twim_074_m64.mp3.recovered
/home/jschiwal/twim_074_m64.mp3.recovered: Audio file with ID3 version 22.0 tag,                          MP3 encoding
jschiwal@hpamd64:/proc/30548> cd
jschiwal@hpamd64:~> cmp twim_074_m64.mp3.recovered podcasts/twim_074_m64.mp3
You might try looking in google or an undelete utility for Linux in sourceforge. There may be one for ext3. It depends on which filesystem you used and whether the server has written to that filesystem since deleting them. You could also create an image of the filesystem and use forensic tools to try to recover the files that were deleted. For text files it may be easier because you may be able to recognize the patterns.

Last edited by jschiwal; 11-28-2007 at 01:10 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Recovering Deleted files brew1brew Mandriva 6 12-24-2005 01:21 PM
Recovering deleted files?? DaFrEQ Linux - General 8 09-17-2005 12:28 PM
recovering deleted files saipraveen Linux - Newbie 1 06-16-2005 11:00 AM
recovering deleted files hamish Linux - Newbie 2 10-04-2004 05:51 PM
Recovering Deleted Files Brian of Gep Linux - Newbie 1 03-02-2004 02:26 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 07:21 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration