LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 02-10-2013, 05:00 AM   #1
bobobagins
LQ Newbie
 
Registered: Feb 2013
Posts: 7

Rep: Reputation: Disabled
Question Undo rm -rf dir


I accidentally executed "rm -rf" on the wrong directory. After going through various posts on several websites, i have tried photorec, testdisk, extundelete. Only following cmd works.
Code:
sudo extundelete --restore-all /dev/mapper/udisks-xxxxx
This cmd copies 'all' deleted files on that partition into a RECOVERED_FILES dir inside home dir. This will fill up all the free space i have.

Is there any way to undelete 'only the directory' in its original location. As directory is technical just a file, wont that in turn recover the files under it?

I tried the directory recovery feature of extundelete, but it wont work.
Code:
sudo extundelete --restore-directory /media/encryptedPartitionA/mydir/ /dev/mapper/udisks-xxxxx
Gave message:
Code:
Failed to restore file /media/encryptedPartitionA/mydir/
Could not find correct inode number past inode 2.
 
Old 02-10-2013, 01:23 PM   #2
Snark1994
Senior Member
 
Registered: Sep 2010
Distribution: Debian
Posts: 1,632
Blog Entries: 3

Rep: Reputation: 346Reputation: 346Reputation: 346Reputation: 346
Restoring directories which have been "rm -rf" is generally Black Magic in Linux - there's a thread on it at least once a month here at LQ, and I've never successfully recovered one. The "solution" is to make regular backups, and not to be trigger-happy with your rm's (zsh at least has a feature where it asks you to confirm that you want to delete the contents of a directory, in case you made a typo). Some people also change their 'rm' command for a command which just moves the file(s) to a trash folder, like deleting files using a window manager.

In terms of trying to fix the problem as it is, do you have any external hard drives (or similar) which you could mount to give you extra room (extundelete makes the 'RECOVERED_FILES' directory in the current directory you're in, which doesn't need to be your home directory)? Or moving some of the files on your hard drive to another computer/hard drive, recovering, deleting the ones you don't need, and restoring the files you moved?
 
Old 02-10-2013, 10:11 PM   #3
John VV
LQ Muse
 
Registered: Aug 2005
Location: A2 area Mi.
Posts: 17,502

Rep: Reputation: 2617Reputation: 2617Reputation: 2617Reputation: 2617Reputation: 2617Reputation: 2617Reputation: 2617Reputation: 2617Reputation: 2617Reputation: 2617Reputation: 2617
stop using the "f" option !!!
use "-i" or " -I"
and stop using "force"

see :
Code:
rm --help
man rm 
-- or it is listed as ---
man 1 rm
 
Old 02-11-2013, 12:36 AM   #4
bobobagins
LQ Newbie
 
Registered: Feb 2013
Posts: 7

Original Poster
Rep: Reputation: Disabled
@Snark1994
making more space or using external hdd, is pretty much straight forward, if i opt to use the restore-all way. Was seeking help to avoid that.
---

I have been able to get the inode number of the directory that was deleted. Is it possible to grep or dd the 'directory file'? And will getting back 'directory file' in its location lead to reverting back to previous state, i.e, all contents intact?
 
Old 02-11-2013, 02:32 AM   #5
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 7.7 (?), Centos 8.1
Posts: 17,814

Rep: Reputation: 2553Reputation: 2553Reputation: 2553Reputation: 2553Reputation: 2553Reputation: 2553Reputation: 2553Reputation: 2553Reputation: 2553Reputation: 2553Reputation: 2553
Unless you stopped using that partition immediately, its possible the system would have started to re-use that space.
You may be out of luck...
 
Old 02-11-2013, 04:28 AM   #6
bobobagins
LQ Newbie
 
Registered: Feb 2013
Posts: 7

Original Poster
Rep: Reputation: Disabled
@chrism01
There is no problem in bulk data retrieval and it is obvious thing that the partition should be kept untouched, until recovery is complete.

@all
Anyone here ever used grep or dd to retrieve back a directory using inode? I have seen examples of retrieving files with inode information, but not sure about retrieving directory & its consequence.
 
Old 02-11-2013, 08:15 AM   #7
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
Quote:
Originally Posted by bobobagins View Post
Is there any way to undelete 'only the directory' in its original location.
Apart from manual fiddling with 'debugfs' I'm not aware of any tool that would cause that. (That doesn't mean there aren't any, just that I only know to use common recovery and forensic tools, and yes, I have helped LQ members recover files successfully more than once.) As the others hinted at it would not be a best practice either.


Quote:
Originally Posted by bobobagins View Post
As directory is technical just a file, wont that in turn recover the files under it?
No, that's just wishful thinking. You may have read the "everything is a file" phrase. Simply put this means each single file is represented by a single inode. It tells the file system where to find the (small) file, where to find the first n blocks (larger file, direct blocks) plus where to find the blocks that point to other blocks (indirect secondary and tertiary block addrs). Given aspects like default file system block size, the size of files and the "cost" attached to disk write ops and how the kernel deals with writes it is no wonder block allocation isn't contiguous and given how a file system like Ext deals with allocation there's generally speaking no need for it either. That's files. Directories are files too in the sense that its inode serves as a kind of "index", holding information about the items it contains. This means that once a directory gets deleted the "index", the link between directory inode and file inode, is gone and recreating the directory inode does not automagically mean re-populating its "index".

Tools like Photorec, Scalpel and Foremost try to bypass problems by looking for files directly as file types often have a specific header (see 'man magic') and footer. But since block allocation isn't contiguous this may incorporate for example part of a header-less file B between header A and footer C.

On top of that, by allowing time to pass, not freezing the file system the instant a deletion happened, the system will continue to re-allocate freed up blocks. And every action be it involuntarily like journal syncing, daemons and subsystems running in the background, or voluntarily like any command you execute in the shell, can trigger a write op. The most encountered mistakes I've seen are installing software, rebooting, running fsck on corrupted file systems, not remounting disks in read-only mode (also see "-o ro,norecovery,noload") and not making a copy of the disk or partition before messing with it.

Testdisk allows you to try and "walk" the file system by attaching it to the disk or partition (like for example 'testdisk /debug /log /dev/sda1' for the latter), Proceed > None > Advanced > Undelete. There you should see directories and files in red if unlinked. If it's a very recent deletion you may encounter deleted files listed in the parent directory of the deleted directory where you can select them and copy them to a different partition or disk. Else you can at least use Testdisk as a convenient tool to do recon with and at least verify you can still see items or not. *Talking about convenience: as you can guess from the above file recovery isn't the type of situation where what you would "like" is a valid reason or has any priority but what's possible or not.


Quote:
Originally Posted by bobobagins View Post
Code:
Failed to restore file /media/encryptedPartitionA/mydir/
What does this mean? That the file system to recover from is an encrypted one and you tried to recover to the same file system?
 
1 members found this post helpful.
Old 02-11-2013, 10:57 AM   #8
bobobagins
LQ Newbie
 
Registered: Feb 2013
Posts: 7

Original Poster
Rep: Reputation: Disabled
@unSpawn
I had used debugfs earlier to get logdumps of the inode, for using with grep for retrieving the directory file. I wrongly assumed that the index to the underlying files was part of the 'directory file' and was hoping that restoring the 'directory file' will fix things.

Quote:
What does this mean? That the file system to recover from is an encrypted one and you tried to recover to the same file system?
No, it means i did not read the docs carefully. It needs the path relative to the partition, i gave path wrt root.

After giving the relative path, the directory & its contents were recovered. It pretty good, as i didnt had to use the --restore-all option, which recovers deleted stuff from the entire partition.

Thanks for the responses!

Last edited by bobobagins; 02-11-2013 at 10:58 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
exclude parameter of rsync- 'dir' vs "dir" vs dir rng Linux - General 5 06-13-2012 02:47 AM
Web Root Dir Change and New Dir Added issue in CentOS 5 Ginnyz Linux - Server 2 06-01-2009 09:29 PM
deny accessing the dir but still allow images in the dir to be used by 'HTML' wikignu Linux - Server 2 01-12-2009 10:04 AM
Command to display /dir, /dir/sub, /dir/sub/files knockout_artist Linux - Newbie 9 10-25-2007 03:57 PM
Share configuratin dir (.dir) for 3 accounts on local computer LiNuXkOlOnIe Linux - Software 5 01-08-2006 04:36 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 03:47 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration