How to undelete data from command "rm -rf /var"

takaruz · 12-11-2012, 05:14 AM

i was SSH to my server. i used wrong cmd. i want to unlink var directory but i typed rm -rf /home/var (softlink to /var) and then, my /vat was gone

i tying to search some issue to solve that problem. i found "extundelete" but i cant ./configure it show

Code:

Configuring extundelete 0.2.0
configure: error: C++ compiler cannot create executables
See `config.log' for more details.

and i try to yum it get message...

Code:

Loaded plugins: fastestmirror, refresh-packagekit, security
Loading mirror speeds from cached hostfile
removing mirrorlist with no valid mirrors: /var/cache/yum/x86_64/$releasever/base/mirrorlist.txt
Error: Cannot find a valid baseurl for repo: base

then, i try to use testdisk it can recovery my delete files back but it not all file !!! how can i get back my /var plz help me i lose a lot of mysql and somethind important in /var

unSpawn · 12-11-2012, 06:32 AM

Welcome to LQ, even on such a sad occasion, hope you like it here.

Quote:

Originally Posted by takaruz

i typed rm -rf /home/var (softlink to /var) and then, my /vat was gone

I'm sorry to hear that. Do you make regular backups or do you have any backups?

Quote:

Originally Posted by takaruz

i tying to search some issue to solve that problem. i found "extundelete" but i cant ./configure it show

Code:

See `config.log' for more details.

The hint is in the message: it tells you exactly where to look.

Quote:

Originally Posted by takaruz

and i try to yum it get message...

When you deleted /var all files were unlinked. The best way to fsck up recovery is by issuing commands you have no idea about what they cause, especially when they try to write to /var. If the machine wasn't rebooted after deletion and no processes were stopped then the current processes may keep some files open on their file descriptors. Since /var is gone using 'lsof' may be unusable but you could list file descriptors and files with

Code:

lsof -Pwlnd0-255|awk '/var\// {if ($4 ~ "w" ) print "/proc/"$2"/"$4, $NF}'

or

Code:

find /proc/[0-9]*/fd/* -ls 2>/dev/null|grep var/|awk '{print $11, $13}'|sort -u|while read DESCR ITEM; do
 cat "${DESCR}" >> "/other/partition/${ITEM//*\//}"; done

Quote:

Originally Posted by takaruz

then, i try to use testdisk it can recovery my delete files back but it not all file !!!

The best way to get a chance at file recovery would have been to immediately make a 'dd' copy of the partition that holds /var to a file on a physically different disk. Then use Photorec, not Testdisk, to recover files. There is no guarantee all your files can be recovered, for example Photorec only recognizes certain MySQL file types, and some file types don't include enough header or footer information to be exact about it. Furthermore pitfalls you wouldn't want to know anything about like the effect of write operations, secondary and tertiary block allocation and Journaling make recovery harder.

takaruz · 12-19-2012, 04:23 AM

thx u, unSpawn

i try to get my server back but it gone...

now, i setup a new server and i get some data from google webcache.