LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Software (https://www.linuxquestions.org/questions/linux-software-2/)
-   -   recovery files deleted in Linux (https://www.linuxquestions.org/questions/linux-software-2/recovery-files-deleted-in-linux-145441/)

Nandex 02-12-2004 06:32 PM

recovery files deleted in Linux
 
hi all.
I have trouble getting a sotware to recovery deleted files in linux (ext2, ext3), if you know of some please , you can tell me, I'll be waiting your answers , thanks a lot.

spuzzzzzzz 02-12-2004 08:05 PM

If you delete a file using the command "rm", you can't recover it. If you are using gnome or kde and you delete a file by clicking on it and pressing "delete" then you can recover it by double clicking on the trash can on the desktop.

Kristijan 02-12-2004 09:58 PM

Not entirly true spuzzzzzzz. There are forms of data recovery that can recover deleted data. From my understanding, data is not deleted. It is only deleted when another chunk of data overwrites it.

With Nandex's case though, once the data is deleted, playing with application software and what not would most likely make the data harder to retreive. Not 100% on all this though, so don't go quoting me. I'm trying to remember from a talk at ruxcon last year.

http://www.ruxcon.org

spuzzzzzzz 02-13-2004 12:47 AM

From what I understand, the only thing actually deleted is the inode for the file. The data from the file is still there (unless something else tries to use that part of the disk) but the only way I could possibly imagine to recover it would involve knowing the exact position on the disk of the deleted file. If there is a different way, though, I would be extremely interested in knowing it.

hiteshmaisheri 02-13-2004 12:58 AM

is there any software that does the recovery for us???? Can anyone sugges some sofware on it????

Nandex 02-13-2004 12:14 PM

Hi all.
thanks for the answers, I was looking for some programs , and I find some here ,http://freshmeat.net/search/?q=delet...tion=projects, you can dowload this and prove it .
I proved some of this programs, but I didn't have luck, I think maybe because most of them is only for Ext2 and not Ext3,i find one that maybe function, the problem is that you have to know the blocks o inodes,it's a little to difficult to use, but I will try to find other one, tell me if you have better luck than me , ok?, Good luck.

aigartua 02-13-2004 04:16 PM

You can undelete manually.

Step 1: Stop write your hd,

Step 2: type

root#debugfs /dev/hda1

I suppose the file you want to recover is on /dev/hda1 .

Step 3:

debugfs:lsdel

list the file you delete recently.

pay more attention on file's inode,

debugfs:dump <file inode> yourhome

then you will find file in yourhome directory.

hiteshmaisheri 02-14-2004 12:12 AM

thanx for the help ... will check out the results of it...

Nandex 02-14-2004 04:22 PM

Thanks for the help too aigartua, I did that , but in the step3 (lsdel),
I get 0 inodes founded :(, anyway , I'll try to find other solution, thanks
Greetings.


All times are GMT -5. The time now is 05:09 AM.