LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 04-24-2006, 12:45 AM   #1
scbops
Member
 
Registered: Feb 2006
Posts: 97

Rep: Reputation: 15
Data Recovery


1)It say's that when removing files using rm command physically data is not deleting only the inode entry is removing.

2)Is it possilble to recver deleted data if know the deleted file inode number
 
Old 04-24-2006, 02:38 AM   #2
Randux
Senior Member
 
Registered: Feb 2006
Location: Siberia
Distribution: Slackware & Slamd64. What else is there?
Posts: 1,705

Rep: Reputation: 55
For journaling filesystems, it is generally not possible to recover data. Which filesystem are you using?
 
Old 04-24-2006, 05:12 AM   #3
scbops
Member
 
Registered: Feb 2006
Posts: 97

Original Poster
Rep: Reputation: 15
ext3 (third extended linux file system)
 
Old 04-24-2006, 05:37 AM   #4
Randux
Senior Member
 
Registered: Feb 2006
Location: Siberia
Distribution: Slackware & Slamd64. What else is there?
Posts: 1,705

Rep: Reputation: 55
I think people have said that when you delete a file on ext3, it's really deleted.
 
Old 04-24-2006, 05:51 AM   #5
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
It would have been a good thing to have searched this forum and LQ because we have had a lot of threads about deletion.
Basically, if you had the data in places that would not be written over immediately and if you took measures against writing over data immediately after deleting files then there is a chance (small) of recovery (partial) using "foremost" for images and documents (search in this forum) or "grep" for text data.

You could try and comb over the drive with forensics tools but that is not a trivial task with respect to the learning curve (steep), the time you need (more than you guesstimate), diskspace (as much as you can get but at least twice the disksize on a different drive). Even then there is no guarantee for recovery so it has a discouragingly low ROI.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Need help with data recovery. A.C. Helm Linux - Newbie 2 10-15-2005 10:58 AM
data recovery? xushi Slackware 2 07-04-2005 05:02 PM
Data Recovery plisken General 3 07-04-2004 01:06 PM
CD-RW Data Recovery rignes Linux - Software 0 05-21-2004 05:52 PM
Data recovery replys2me Linux - Software 2 06-04-2003 09:05 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 12:53 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration