LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 11-22-2015, 09:46 AM   #1
D-kikin
LQ Newbie
 
Registered: Nov 2015
Posts: 12

Rep: Reputation: Disabled
Question Recover deleted images with standard Linux tools from the command line


Intro: On my quest to master the Linux command line I enrolled in a Linux class. Assistance provided will aid me in answering this Linux challenge.

I am a firm believer in teaching how to fish vs. get a fish. So I researched for two days. Unfortunately all the stuff I found did not quite address my unique problem or I am not understanding a concept; hence me being here.

Problem: A user copied some image files to ~/Image/folder. After she transferred the images the user deleted the files. I am to recover the deleted files. I was not told any other information like the name of the files/folder.

Research: Upon research I read about the following downloaded applications that would make this task a no-brainier:
- Testdesk
- Photorec
- etc

BUT the problem is I am required to use tools that came with the distro.
It didn't look like extundelete or ext3undel was install; no man page found. I did however find 'dd' and 'debugfs' but I am not sure how those would be helpful.

I tried using 'debugfs' but couldn't get it to work. I could find /dev mount point. After running the 'df' on the distro the following is the output:

Filesystem Size Used Available Use% Mounted On
rootfts 908.9M 457.7M 451.2M 50% /
tmpts 908.9M 457.7M 451.2M 50% /
tmpts 504.9M 0 504.9M 0% /dev/shm

{Can someone explain this?}

Attempts:

- Then I tried running the following command {Not sure if this is could help}: 'debugfs /usr/kayt' and got the following error: 'Attempt to read block from filesystem resulted in short read while opening filesytem'

Then I tried: grep -b 'search-text' /dev/partition > file.txt
but again there is no /dev to umount.

I am not sure whatelse to do so please help. I am a newbie to Linux so please keep your comments straight forward. I have a very basic knowledge of the OS so please provide example of syntax when replying. Thanks for your help.
 
Old 11-22-2015, 10:52 AM   #2
topernic
LQ Newbie
 
Registered: Sep 2014
Distribution: arch, ubuntu, debian
Posts: 15

Rep: Reputation: Disabled
What distro are you using?

TestDisk and PhotoRec can be installed on Linux - http://www.cgsecurity.org/wiki/TestDisk_Download
 
Old 11-22-2015, 10:59 AM   #3
D-kikin
LQ Newbie
 
Registered: Nov 2015
Posts: 12

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by topernic View Post
What distro are you using?

TestDisk and PhotoRec can be installed on Linux - http://www.cgsecurity.org/wiki/TestDisk_Download
Linux 2.6.30.6 - SLITAZ i686

For the purpose of the assignment I am not allowed to install any tools. I must use the tools it came pre-installed with.
 
Old 11-22-2015, 02:46 PM   #4
normanlinux
Member
 
Registered: Apr 2013
Location: S.E. England
Distribution: Arch
Posts: 161

Rep: Reputation: Disabled
Quote:
Originally Posted by D-kikin View Post
Linux 2.6.30.6 - SLITAZ i686

For the purpose of the assignment I am not allowed to install any tools. I must use the tools it came pre-installed with.
Sounds like your tutor is a plonker! Although you could suggest looking in the recycle bin since most graphical interface tools do a soft delete and move the deleted files there. Since your assignment didn't say that the files were deleted from the command line you should be good to go.

Last edited by normanlinux; 11-22-2015 at 02:48 PM.
 
1 members found this post helpful.
Old 11-22-2015, 03:35 PM   #5
D-kikin
LQ Newbie
 
Registered: Nov 2015
Posts: 12

Original Poster
Rep: Reputation: Disabled
Angry No Trash Can

Quote:
Originally Posted by normanlinux View Post
Sounds like your tutor is a plonker! Although you could suggest looking in the recycle bin since most graphical interface tools do a soft delete and move the deleted files there. Since your assignment didn't say that the files were deleted from the command line you should be good to go.
My day just seems to be getting better. I just spend 30 mins looking for the trash can/recycle bin following the this with no luck. However, I was able to find /root/.local/share, but no trash.
 
Old 11-22-2015, 06:46 PM   #6
Billy W
LQ Newbie
 
Registered: Nov 2015
Posts: 3

Rep: Reputation: Disabled
Quote:
Originally Posted by D-kikin View Post
Linux 2.6.30.6 - SLITAZ i686

For the purpose of the assignment I am not allowed to install any tools. I must use the tools it came pre-installed with.
grep is a standard command and is installed on many linux systems.

Since you are not allowed to install anything for your assignment, you can try this:

Recovering Deleted Files with Grep

This video is from Kris Occhipinti, a well known linux expert. I learned a lot of linux tips and tricks from his channel. The instructions starts in 7 mins of the video.

BUT! If it were me, I would use testdisk/photorec over the method above.

BTW, the usual steps to insure recovery of files is to stop writing to the disk immediately. Rebooting the system with a livecd or liveUSB and then run testdisk/photorec from the livecd/liveUSB and writing the recovered files to another partition or drive.

Testdisk/photorec can also be filtered to recover only certain files eg. images.

Anyway, good luck

Last edited by Billy W; 11-22-2015 at 06:55 PM.
 
Old 11-22-2015, 06:57 PM   #7
D-kikin
LQ Newbie
 
Registered: Nov 2015
Posts: 12

Original Poster
Rep: Reputation: Disabled
Question No /dev to umount

Quote:
Originally Posted by Billy W View Post
grep is a standard command and is installed on many linux systems.

Since you are not allowed to install anything for your assignment, you can try this:

Recovering Deleted Files with Grep

This video is from Kris Occhipinti, a well known linux expert. I learned a lot of linux tips and tricks from his channel. The instructions starts in 7 mins of the video.



If it were me, I would use testdisk/photorec over the method above.

BTW, the usual steps to insure recovery of files is to stop writing to the disk immediately. Rebooting the system with a livecd or liveUSB and then run testdisk/photorec from the livecd/liveUSB.

Testdisk/photorec can also be filtered to recover only certain files eg. images.

Anyway, good luck
I did watch is video. But in his video he demo using a USB that was mounted and umounted. I am using a distro that is a VM and no /dev (see my out from running 'df'). I am not sure if I can umount the filesystems on the distro (see my output from running the 'df' command). I also read about the tools you mentioned but not allowed to use them.
 
Old 11-22-2015, 07:03 PM   #8
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 7.7 (?), Centos 8.1
Posts: 17,860

Rep: Reputation: 2596Reputation: 2596Reputation: 2596Reputation: 2596Reputation: 2596Reputation: 2596Reputation: 2596Reputation: 2596Reputation: 2596Reputation: 2596Reputation: 2596
I just wanted to emphasise this
Quote:
BTW, the usual steps to insure recovery of files is to stop writing to the disk immediately. Rebooting the system with a livecd or liveUSB and then run testdisk/photorec from the livecd/liveUSB.
As soon as the system removes a file, the relevant disk blocks are marked as available for (re-)use.
Hence, even in a test env, you need to stop using that partition asap.
 
Old 11-22-2015, 07:11 PM   #9
D-kikin
LQ Newbie
 
Registered: Nov 2015
Posts: 12

Original Poster
Rep: Reputation: Disabled
Question

Quote:
Originally Posted by chrism01 View Post
I just wanted to emphasise this

As soon as the system removes a file, the relevant disk blocks are marked as available for (re-)use.
Hence, even in a test env, you need to stop using that partition asap.
I understand that. The problem I'm having is I do not know how to do exactly that; that is if that is the way to get back the files.
 
Old 11-22-2015, 07:40 PM   #10
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 7.7 (?), Centos 8.1
Posts: 17,860

Rep: Reputation: 2596Reputation: 2596Reputation: 2596Reputation: 2596Reputation: 2596Reputation: 2596Reputation: 2596Reputation: 2596Reputation: 2596Reputation: 2596Reputation: 2596
Basically you need to unmount the partition (umount cmd as root user), but this only works if nothing is using it, else it'll say 'filesystem busy...' or similar.

Its good for you to learn about tools that theoretically can recover files, but in the real world you'd normally rely on backups, especially for a shared or server system.
Unmounting and/or shutting down a system may not be an option.

(PS that's not a typo; the umount cmd really does not have an 'n' in the name )
 
Old 11-22-2015, 07:50 PM   #11
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 4,547

Rep: Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082
If your only access is through the VM running on that filesystem, your options are very limited. You could try "debugfs -w rootfs", use "ls -d" on likely directories to find deleted files, and then "undel <inode_number> pathname" to attempt recovery. However, "undel" can leave the filesystem in an inconsistent state requiring fsck, and could cause major problems if done on a filesystem that is currently mounted.

In a real-world scenario, you would not be doing this on the mounted filesystem for a running system.

I should add that "major problems" could include anything up to and including a system crash with permanent loss of data.

Last edited by rknichols; 11-22-2015 at 07:52 PM. Reason: I should add that ...
 
Old 11-23-2015, 03:10 AM   #12
normanlinux
Member
 
Registered: Apr 2013
Location: S.E. England
Distribution: Arch
Posts: 161

Rep: Reputation: Disabled
Quote:
Originally Posted by D-kikin View Post
My day just seems to be getting better. I just spend 30 mins looking for the trash can/recycle bin following the this with no luck. However, I was able to find /root/.local/share, but no trash.
It is probable that the files were deleted as a normal user. Each user will have a .local/share/trash in their home directory
 
Old 11-23-2015, 04:01 AM   #13
TobiSGD
Moderator
 
Registered: Dec 2009
Location: Germany
Distribution: Whatever fits the task best
Posts: 17,148
Blog Entries: 2

Rep: Reputation: 4871Reputation: 4871Reputation: 4871Reputation: 4871Reputation: 4871Reputation: 4871Reputation: 4871Reputation: 4871Reputation: 4871Reputation: 4871Reputation: 4871
Quote:
Originally Posted by Billy W View Post
BTW, the usual steps to insure recovery of files is to stop writing to the disk immediately. Rebooting the system with a livecd or liveUSB and then run testdisk/photorec from the livecd/liveUSB and writing the recovered files to another partition or drive.
Slitaz actually is a live system running in RAM.
 
Old 11-23-2015, 07:21 AM   #14
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 4,547

Rep: Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082
Quote:
Originally Posted by TobiSGD View Post
Slitaz actually is a live system running in RAM.
Then it's likely that the root filesystem is not ext2/3/4 and debugfs won't work on it. IMO, this exercise is so far removed from what would/could/should be done on a real system that it's pretty much pointless.
 
Old 11-23-2015, 10:50 AM   #15
John VV
LQ Muse
 
Registered: Aug 2005
Location: A2 area Mi.
Posts: 17,520

Rep: Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619
Quote:
It is probable that the files were deleted as a normal user. Each user will have a .local/share/trash in their home directory
only if the user used the " move to trash" on the r-click menu

if DELETE on the r-click menu is used it is NOT moved to the trash cam

nor is it moved if the "rm" command is used or my preferred "srm" is used

recovery after srm would be "fun"

but recovery might be made easier or harder depending on the file system used

and recovery of a deleted folder is why i keep a "SystemRescueCD" around and a Knoppix cd
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
LXer: How to optimize images in Ubuntu (GNU/Linux) using command line tools LXer Syndicated Linux News 0 06-29-2015 04:10 PM
[ANNOUNCE] - V-tools, a set of unix/linux command line tools veerain Linux - Software 6 05-18-2015 08:22 AM
LXer: 5 Best Data Recovery Tools For Linux To Recover Data Or Deleted Partitions LXer Syndicated Linux News 0 04-18-2015 02:32 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 07:40 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration