Linux - SoftwareThis forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
Location: Under the bridge where proper engineers walkover
Distribution: Various Linux, Solaris, BSD, Cisco
Posts: 443
Rep:
Urgent!!! Recovery of data
Hi,
I managed to accidently wipe some important folders containing about 24GB of data using the rm tool from the terminal with the wildcard flag * set which prompted the unwanted erase.
Does anyone know how to get it back?
I haven't touched the disk since it's a secondary drive currently.
If anyone knows anything I would be SOOOOOO greatfull
More than likely, it's gone for good. If it's on an ext2 system this may help: http://www.stud.tu-ilmenau.de/~mojo/undelete.html. It's on an ext3 system, I've read that you're out of luck. Someone recommended photorec which is part of the testdisk package. You should also do a search here on LQ on the phrase "recover deleted data".
There is an undelete function in the latest versions of midnight commander which may help you. It works on an unmounted partition. Google midnight commander undelete and you should get some information on it.
Location: Under the bridge where proper engineers walkover
Distribution: Various Linux, Solaris, BSD, Cisco
Posts: 443
Original Poster
Rep:
hmm just thought I might be able to use the software on my system however it won't compile as it needs another component which is not available through apt and I'm sure they will complain that Debian's lib files and other files are too old uh
It was gona be a nice evening tonight just me and the computer but now has turned into a disaster, oh well maybe after some sleep I might become lucky or if anyone has any other suggestions it would be great!
Location: Under the bridge where proper engineers walkover
Distribution: Various Linux, Solaris, BSD, Cisco
Posts: 443
Original Poster
Rep:
Quote:
There is an undelete function in the latest versions of midnight commander which may help you. It works on an unmounted partition. Google midnight commander undelete and you should get some information on it.
Rich
Oh thanks Rich was just typing I think when you posted!
I will apt-get m-c now and take a look quickly before turning in for the night.
Magicrescue seems to be for corrupted patitions and The Sleuth Kit more for forensic analysis, one of these tools is going to work somehow for me but at the moment I'm not understanding their manual pages!!
They keep talking about using an image of the drive but don't tell you how to create one or where to put it to use it?
In worst case scenario you can still recover files with intact headers using foremost.
Next time you should try to use a wrapper to prevent deleting of very important stuff, for example I use this:
Code:
#!/bin/sh
# this script takes only 2 arugments total
if test "$#" != 2
then
# fail
echo 'ERROR: This script requires exactly 2 arguments'
exit 1
fi
# don't delete things 2 levels from the root directory
if find / -type d -maxdepth 2 | grep "$2" 1> /dev/null
then
# fail
echo "ERROR: Bad idea, will not remove $2"
exit 1
fi
rm "$1" "$2"
# success
exit 0
Last edited by H_TeXMeX_H; 11-01-2008 at 10:43 AM.
Location: Under the bridge where proper engineers walkover
Distribution: Various Linux, Solaris, BSD, Cisco
Posts: 443
Original Poster
Rep:
Thanks H_TeXMeX_H, I will have a look at the manual and howtos for foremost.
Since I just need to recover these files and nothing major I need fast quick and simple, but obviously if it takes time then it will take as long as it needs!!
Location: Under the bridge where proper engineers walkover
Distribution: Various Linux, Solaris, BSD, Cisco
Posts: 443
Original Poster
Rep:
Ok done the reading, currently two major questions come to mind:
1. What is the image.dd file that everyone talks about and how do I create one?
2. Can I recover the file names used aswell, is this the function of foremost?
I've run magicrescue and it's cycling currently but the names are not there, well actually I don't see the proper files there either yet as it claims that there isn't sound on any file??
You use 'dd' to create image.dd, say you have a partition called /dev/hdb1, to make at image you run this from a different partition:
Code:
dd if=/dev/hdb1 of=image.dd
This will make byte for byte copy of the partition to a file called image.dd (it will be large). Then you can scan that image using foremost or other tools.
No tool that I know of can recover file names, sorry.
Oh, and be careful using dd it stands for data destroyer.
Last edited by H_TeXMeX_H; 11-01-2008 at 11:30 AM.
Location: Under the bridge where proper engineers walkover
Distribution: Various Linux, Solaris, BSD, Cisco
Posts: 443
Original Poster
Rep:
Thanks for the tip!
I have no idea if this will work as magicrescue has only found 4MB videos so far and not the 350MB ones that I need, mind you it is a 250GB drive with only one partition spanning the drive so I guess be patient and hope for the best.
If not I will try The Sleuth Tookkit and see if that works, although I don't have anywhere to put the image file if as you say the image is of the partition as that would mean 250GB - oh boy... hmm an external drive might do the trick here.
Well using the command you gave:
Quote:
dd if=/dev/hdb1 of=image.dd
This will make byte for byte copy of the partition to a file called image.dd (it will be large). Then you can scan that image using foremost or other tools.
Would that mean that the information in the drive will be lost but instead transferred to the image?
So say where output of=image.dd will be in a directory, eg. /usr/image or /mnt/external_drive/image
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.