LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 03-08-2006, 11:05 AM   #1
ice99
Member
 
Registered: Aug 2005
Posts: 51

Rep: Reputation: 15
how to restore deleted files?


hi all. i have a little problem. i have deleted some files from my /var/www/html directory yesterday and i don't have a backup. so is there is a way to restore this this files again? i know under windows there are some programs who can do that but i don't know for linux.

thanks in advance
 
Old 03-08-2006, 11:43 AM   #2
spoody_goon
Member
 
Registered: Sep 2003
Location: Michigan USA
Distribution: Mandrake, DamnSmallLinux, VectorLinux
Posts: 416

Rep: Reputation: 30
This may seem obvious but did you check your trash?
 
Old 03-08-2006, 11:54 AM   #3
nx5000
Senior Member
 
Registered: Sep 2005
Location: Out
Posts: 3,307

Rep: Reputation: 57
If and only if you have not rebooted, copy /dev/kcore somewhere and then try to find something in this file.
You may get a good percentage of your files depending on what you did meanwhile.

Also this, I think it works with the disk and not the ram:
http://freshmeat.net/projects/unrm/
 
Old 03-08-2006, 11:58 AM   #4
ice99
Member
 
Registered: Aug 2005
Posts: 51

Original Poster
Rep: Reputation: 15
i tried this link and the program is working just fine. anyway the problem is that this program is only works with ext2 but my partitions are ext3. also under /dev i have just this files:

full log null ptmx pts/ random reboot tty urandom zero



is there a possibility kcore to be on some other location?

thanks


Quote:
Originally Posted by nx5000
If and only if you have not rebooted, copy /dev/kcore somewhere and then try to find something in this file.
You may get a good percentage of your files depending on what you did meanwhile.

Also this, I think it works with the disk and not the ram:
http://freshmeat.net/projects/unrm/

Last edited by ice99; 03-08-2006 at 12:05 PM.
 
Old 03-09-2006, 03:12 AM   #5
nx5000
Senior Member
 
Registered: Sep 2005
Location: Out
Posts: 3,307

Rep: Reputation: 57
What is your distribution?
 
Old 03-09-2006, 03:50 AM   #6
ice99
Member
 
Registered: Aug 2005
Posts: 51

Original Poster
Rep: Reputation: 15
It is CentOs 4


Quote:
Originally Posted by nx5000
What is your distribution?
 
Old 03-09-2006, 03:55 AM   #7
spooon
Senior Member
 
Registered: Aug 2005
Posts: 1,755

Rep: Reputation: 51
Quote:
Originally Posted by ice99
my partitions are ext3.
It's really hard or impossible to recover files directly on ext3, since it zeroes out the inodes after you delete them. You may have to do things like grep through the drive to recover your stuff.
 
Old 03-09-2006, 04:02 AM   #8
nx5000
Senior Member
 
Registered: Sep 2005
Location: Out
Posts: 3,307

Rep: Reputation: 57
Quote:
Originally Posted by ice99
It is CentOs 4
Mmmh I won't be of any help, the only centos I have is in a virtual machine and I don't have this machine now.
Maybe centos doesn't use a file for this, maybe ask somewhere else or if you're lucky somebody will pop in..

Also spooon is right, you can dump the disk with dd ( TO ANOTHER DISK )
I don't know the physical structure of ext3.

In any case, do not reboot and try to not touch this disk.
 
Old 04-01-2006, 01:50 AM   #9
Simon Bridge
LQ Guru
 
Registered: Oct 2003
Location: Waiheke NZ
Distribution: Ubuntu
Posts: 9,211

Rep: Reputation: 198Reputation: 198
You have to grep through the partition... look for the content of the file.
 
Old 04-01-2006, 02:16 AM   #10
Simon Bridge
LQ Guru
 
Registered: Oct 2003
Location: Waiheke NZ
Distribution: Ubuntu
Posts: 9,211

Rep: Reputation: 198Reputation: 198
http://www.linuxquestions.org/questi...d.php?t=428962
http://www.linuxquestions.org/questi...grep+partition

Basically the pattern is:

grep -a --color -A3 -B1 sometext /dev/hdxy
 
Old 04-12-2006, 09:21 AM   #11
konramesh
LQ Newbie
 
Registered: Jan 2006
Posts: 3

Rep: Reputation: 0
use debugfs command; check the deleted files with lsdel command, u can use rdump command to restore the files! ofcourse it may not restore all the files.


ramesh
 
Old 04-12-2006, 11:49 AM   #12
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3596Reputation: 3596Reputation: 3596Reputation: 3596Reputation: 3596Reputation: 3596Reputation: 3596Reputation: 3596Reputation: 3596Reputation: 3596Reputation: 3596
Grepping can do if you're mainly concerned with text. You could try a header/footer based approach (think file: magic) using "foremost". RPMForge and Dries repositories have rpm's for it. Running it as "foremost -a -d -v -T -t all -i /dev/hdb1 -o /tmp/foremost" (where hdb1 is the remounted-read-only partition and /tmp/foremost the output dir) recovered 11 out of 24 files after deleting the dirs. Lsdel and debugfs can only be used on ext2fs.
 
Old 04-12-2006, 08:33 PM   #13
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 380Reputation: 380Reputation: 380Reputation: 380
Quote:
Originally Posted by nx5000
If and only if you have not rebooted, copy /dev/kcore somewhere and then try to find something in this file.
You may get a good percentage of your files depending on what you did meanwhile.
hi, i'm trying this just for educational purposes (i don't really need to recover anything)... i assume you mean /proc/kcore, right?? well, i did a:
Code:
cat /proc/kcore > /tmp/kcore
and i ended-up with a file 543MB in size...

how would i go about searching this file for deleted files??
Code:
bash-3.1$ ls -l /tmp/kcore 
-rw-r--r--  1 root root 568926208 2006-04-12 20:30 /tmp/kcore
bash-3.1$ file /tmp/kcore 
/tmp/kcore: ELF 32-bit LSB core file Intel 80386, version 1 (SYSV), SVR4-style, SVR4-style, from 'vmlinux', bad note name size 0xe0800000

Last edited by win32sux; 04-12-2006 at 08:36 PM.
 
Old 04-13-2006, 03:10 AM   #14
nx5000
Senior Member
 
Registered: Sep 2005
Location: Out
Posts: 3,307

Rep: Reputation: 57
Its the contents of your memory (swap / ram )
Well, from here you could play with strings.

strings /tmp/kcore

do you have vi?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
restore deleted rc.conf file fraggelfraggel *BSD 7 10-22-2005 11:53 PM
how to restore deleted items in fluxbox piva.francesco Linux - Software 1 08-29-2005 05:46 AM
Acc deleted key perl files - need to restore Steel Shepherd Linux - Software 1 02-24-2004 11:23 PM
How to restore a deleted file satimis Linux - Newbie 1 09-12-2003 04:18 AM
how to restore deleted files ? ilyes Linux - General 3 08-01-2003 07:13 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 06:54 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration