LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 11-23-2015, 10:51 AM   #16
suicidaleggroll
LQ Guru
 
Registered: Nov 2010
Location: Colorado
Distribution: OpenSUSE, CentOS
Posts: 5,573

Rep: Reputation: 2138Reputation: 2138Reputation: 2138Reputation: 2138Reputation: 2138Reputation: 2138Reputation: 2138Reputation: 2138Reputation: 2138Reputation: 2138Reputation: 2138

Quote:
Originally Posted by D-kikin View Post
Research: Upon research I read about the following downloaded applications that would make this task a no-brainier:
- Testdesk
- Photorec
- etc

BUT the problem is I am required to use tools that came with the distro.

Quote:
Originally Posted by D-kikin View Post
For the purpose of the assignment I am not allowed to install any tools. I must use the tools it came pre-installed with.
I'm not sure I understand a) what the point of this restriction is, or b) what it even means. Testdisk/photorec do not need to be downloaded from a random website, that's rarely how software is installed in Linux. They are included in the standard repository or extended repositories for almost all distros.

So what does "came with the distro" even mean? If it's available on the installation DVD but wasn't installed by default because of the installation type chosen by the user, did it "come with the distro" or didn't it? What if it's on the installation DVD but not the CD? Or what if the user did a net install? Or what if it's in the distro's standard repo but wasn't included on the DVD because of size restrictions?

If you simply mean that no tools can be installed on the machine that weren't already installed when the exercise began, then that simply means your success/failure in this project depends entirely on the type of installation the original user performed, which is a really stupid restriction. Also, what about booting a live distro and doing the recovery from there? testdisk/photorec come standard on all of the recovery distros.

I agree with rknichols - this exercise is so far removed from real life that it's pointless. I have done exactly what this exercise targets. I copied over some images from an SD card to my computer, deleted them off of the SD card, and then due to a small fubar in a processing script I accidentally deleted all of them off of the computer. I then used dd to create a backup image of the SD card, and ran photorec on that backup image, which recovered all of the images flawlessly.

Last edited by suicidaleggroll; 11-23-2015 at 10:58 AM.
 
Old 11-26-2015, 02:32 PM   #17
Fenton(#!)
LQ Newbie
 
Registered: Nov 2015
Posts: 5

Rep: Reputation: Disabled
If some of you use an internal SSD drive with TRIM enabled, recovering files is NOT possible. You CAN however recover files from USB drives and external SSD drives.

http://www.howtogeek.com/187104/warn...external-ssds/
 
Old 11-29-2015, 10:28 AM   #18
D-kikin
LQ Newbie
 
Registered: Nov 2015
Posts: 12

Original Poster
Rep: Reputation: Disabled
Question No Trash Folder????

Quote:
Originally Posted by John VV View Post
only if the user used the " move to trash" on the r-click menu

if DELETE on the r-click menu is used it is NOT moved to the trash cam

nor is it moved if the "rm" command is used or my preferred "srm" is used

recovery after srm would be "fun"

but recovery might be made easier or harder depending on the file system used

and recovery of a deleted folder is why i keep a "SystemRescueCD" around and a Knoppix cd
I went hunting for the trash folder but no luck. As root I ran, "find / -name T*" and no file name trash was listed. I looked at system info and found the following information:

Operating System: Slitaz GNU/Linux 3.0
Desktop Environment: Unknown (Windows Manager: Openbox)
 
Old 11-29-2015, 11:16 AM   #19
John VV
LQ Muse
 
Registered: Aug 2005
Location: A2 area Mi.
Posts: 17,520

Rep: Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619Reputation: 2619
Quote:
SliTaz GNU/Linux is a free operating system working completely in memory from removable media such as a CD-ROM or USB key
as was posted above
if only RAM is used
there is really nothing to recover at lease easily without a full forensic lab
 
Old 11-29-2015, 12:07 PM   #20
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 4,547

Rep: Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082
The root filesystem for SliTaz is a tmpfs in RAM. Unless that user's image folder is located somewhere else on a conventional filesystem, there is nothing to recover.

Somehow I feel the point of this "assignment" is just to encourage some downloads of SliTaz.
 
Old 11-29-2015, 01:36 PM   #21
D-kikin
LQ Newbie
 
Registered: Nov 2015
Posts: 12

Original Poster
Rep: Reputation: Disabled
Question Recovery Folder location

Quote:
Originally Posted by rknichols View Post
The root filesystem for SliTaz is a tmpfs in RAM. Unless that user's image folder is located somewhere else on a conventional filesystem, there is nothing to recover.

Somehow I feel the point of this "assignment" is just to encourage some downloads of SliTaz.
But if files are deleted from the GUI, R-click on file, the distribution is configured to put those files somewhere. Where can I look to find out where those files are?
 
Old 11-29-2015, 02:35 PM   #22
phantomfreak
LQ Newbie
 
Registered: Nov 2015
Posts: 7

Rep: Reputation: Disabled
You can run this command to search for a trash directory and list the contents there in. The wildcards are used in case there are prefixes and suffixes in the directory name. The -iname will match both upper and lower case patterns.


Code:
find /home -type d -iname "*trash*" -exec ls -1 '{}' '+' | less

Or a system wide search

find / -type d -iname "*trash*" -exec ls -1 '{}' '+' | less
But as rknichols mentioned, if the whole filesystem was using tmpfs. All files are gone when you turn off the computer.

Last edited by phantomfreak; 11-29-2015 at 02:45 PM.
 
Old 11-29-2015, 02:45 PM   #23
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 4,547

Rep: Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082
Quote:
Originally Posted by D-kikin View Post
But if files are deleted from the GUI, R-click on file, the distribution is configured to put those files somewhere. Where can I look to find out where those files are?
You can always create a file, delete it from the GUI, then run "find $HOME -cmin -2" to find everything under your home directory that has been changed, renamed, or moved within the last 2 minutes. Then, look for the corresponding location in the other user's account. I do that sort of thing all the time to see where some GUI config tool stores stuff.

But if it were that simple, that user could have recovered the files from his/her trash. I suppose you could see whether your CLI "rm" command is aliased to something that saves deleted files ("type rm" or "type -path rm"), but that isn't standard in SliTaz.

[EDIT] Arrgh! The crippled find command in SliTaz doesn't have "-cmin". Here, the trash bin is in ~/.local/share/Trash/files/ . But as I indicated above, this would have to be a user that lacks the ability to click on the "Trash" icon on the desktop to recover deleted files.

Last edited by rknichols; 11-29-2015 at 02:55 PM. Reason: Arrgh! ...
 
Old 11-29-2015, 04:02 PM   #24
D-kikin
LQ Newbie
 
Registered: Nov 2015
Posts: 12

Original Poster
Rep: Reputation: Disabled
Question

Quote:
Originally Posted by phantomfreak View Post
You can run this command to search for a trash directory and list the contents there in. The wildcards are used in case there are prefixes and suffixes in the directory name. The -iname will match both upper and lower case patterns.


Code:
find /home -type d -iname "*trash*" -exec ls -1 '{}' '+' | less

Or a system wide search

find / -type d -iname "*trash*" -exec ls -1 '{}' '+' | less
But as rknichols mentioned, if the whole filesystem was using tmpfs. All files are gone when you turn off the computer.
This did not return anything.
 
Old 11-29-2015, 04:03 PM   #25
D-kikin
LQ Newbie
 
Registered: Nov 2015
Posts: 12

Original Poster
Rep: Reputation: Disabled
Question Still Nothing

Quote:
Originally Posted by rknichols View Post
You can always create a file, delete it from the GUI, then run "find $HOME -cmin -2" to find everything under your home directory that has been changed, renamed, or moved within the last 2 minutes. Then, look for the corresponding location in the other user's account. I do that sort of thing all the time to see where some GUI config tool stores stuff.

But if it were that simple, that user could have recovered the files from his/her trash. I suppose you could see whether your CLI "rm" command is aliased to something that saves deleted files ("type rm" or "type -path rm"), but that isn't standard in SliTaz.

[EDIT] Arrgh! The crippled find command in SliTaz doesn't have "-cmin". Here, the trash bin is in ~/.local/share/Trash/files/ . But as I indicated above, this would have to be a user that lacks the ability to click on the "Trash" icon on the desktop to recover deleted files.
Hence my problem...
 
Old 11-29-2015, 04:53 PM   #26
rknichols
Senior Member
 
Registered: Aug 2009
Distribution: CentOS
Posts: 4,547

Rep: Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082Reputation: 2082
Quote:
Originally Posted by phantomfreak View Post
But as rknichols mentioned, if the whole filesystem was using tmpfs. All files are gone when you turn off the computer.
Presumably the boot process for this VM sets up the filesystem as though those image files had been created and deleted. If they were deleted via a GUI file manager, then there would be some sort of trash folder. If they were actually unlinked (via rm), then the tmpfs would no longer have any record of their content. Those data blocks would have been released back to the kernel's free memory pool and no longer recoverable except by extraordinary means (freezing the VM and using forensic tools on the host to examine its memory -- that sort of thing).

Last ditch would be to run a "find . -type f" in that user's home directory and see of anything that looks like image files shows up. Frankly, I doubt that will discover anything.

As a final attempt to see what is going on, what is the output from "cat /proc/mounts"?

Last edited by rknichols; 11-29-2015 at 04:57 PM.
 
Old 11-29-2015, 05:37 PM   #27
phantomfreak
LQ Newbie
 
Registered: Nov 2015
Posts: 7

Rep: Reputation: Disabled
In the OP's first post his filesystem is so:

Quote:
Originally Posted by D-kikin View Post
Filesystem Size Used Available Use% Mounted On
rootfts 908.9M 457.7M 451.2M 50% /
tmpts 908.9M 457.7M 451.2M 50% /
tmpts 504.9M 0 504.9M 0% /dev/shm
The / filesystem which includes the home directory is running in ram via tmpfs. So, theoretically, anything the OP did within slitaz is erase when the machine has turn off.

I have an SSD drive and to limit the writes to extend the life of my drive, I have /tmp and /var/log running in a tmpfs filesystem.

When I turn off the computer, all files in /tmp and /var/log are gone. And newer files with the current date are created when the system reboots.

Another idea the OP could have done beforehand is used a sticky bit for the Image directory. If users were given permissions to write to this directory, the sticky bit can prevent other users except root from deleting other user's files. However, sticky bit isn't useful on a tmpfs filesystem unless you keep the machine on 24/7.
 
Old 11-29-2015, 08:12 PM   #28
phantomfreak
LQ Newbie
 
Registered: Nov 2015
Posts: 7

Rep: Reputation: Disabled
I downloaded siltaz 5.0rc3 and ran it in a VM to prove my assumption that a tmpfs filesystem does not keep the created files and directories once the system or VM is shutoff.

Upon booting, siltaz 5.0 has a trash folder on the desktop. From the GUI file manager, I created some files and deleted them by right-clicking on the files. A dialogue opened up and I selected Move to Trash. Upon doing this, the deleted files were in the trash folder.

The second test was to reboot the VM and to see if the deleted files and the Trash directory will be retained.

When the system was up and running again the deleted files in the Trash folder were gone as well as the ./.local/share/Trash directory.

Below are two images of the siltaz desktop. The first one shows the trash folder icon with files in it. I also ran three commands df , uname , and find to show the existence of a Trash directory in the user's home folder.

The second image shows the siltaz filesystem after the reboot. The deleted files are gone from the trash icon as well as the ./local/share/Trash directory.

As you can see, a filesystem using tmpfs is not permanent. Anything you do or create is gone on the next reboot. If you or the other party had installed siltaz on a virtual disk in a VM, this may have been a different story and possibly be able to recover the files.

I'm afraid if you did ran siltaz with a tmpfs filesystem and created some files and then rebooted. Those files are gone.
Attached Thumbnails
Click image for larger version

Name:	1.png
Views:	7
Size:	203.0 KB
ID:	20170   Click image for larger version

Name:	2.png
Views:	7
Size:	196.1 KB
ID:	20171  

Last edited by phantomfreak; 11-29-2015 at 08:47 PM.
 
Old 11-30-2015, 04:32 AM   #29
gunetel
LQ Newbie
 
Registered: Nov 2015
Posts: 4

Rep: Reputation: 0
Quote:
Basically you need to unmount the partition (unmount cmd as root user), but this only works if nothing is using it, else it'll say 'filesystem busy...' or similar.

Its good for you to learn about tools that theoretically can recover files, but in the real world you'd normally rely on backups, especially for a shared or server system.
Unmounting and/or shutting down a system may not be an option.

(PS that's not a typo; the unmount cmd really does not have an 'n' in the name )
does this work the same to Android phone? I need to recover a few photos on my Galaxy S6

Last edited by gunetel; 12-02-2015 at 04:40 AM.
 
Old 11-30-2015, 02:12 PM   #30
phantomfreak
LQ Newbie
 
Registered: Nov 2015
Posts: 7

Rep: Reputation: Disabled
Quote:
Originally Posted by gunetel View Post
does this work the same to Android phone? I need to recover a few photos on my Galaxy S6
With a simple google search there are ways to do so. You'll need to read each link and see which is more doable for you. Some links will use windows based tools or linux based tools. Also, some instructions will be specific to internal, external or both.

Last edited by phantomfreak; 11-30-2015 at 02:20 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
LXer: How to optimize images in Ubuntu (GNU/Linux) using command line tools LXer Syndicated Linux News 0 06-29-2015 04:10 PM
[ANNOUNCE] - V-tools, a set of unix/linux command line tools veerain Linux - Software 6 05-18-2015 08:22 AM
LXer: 5 Best Data Recovery Tools For Linux To Recover Data Or Deleted Partitions LXer Syndicated Linux News 0 04-18-2015 02:32 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 07:37 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration