LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Hardware
User Name
Password
Linux - Hardware This forum is for Hardware issues.
Having trouble installing a piece of hardware? Want to know if that peripheral is compatible with Linux?

Notices


Reply
  Search this Thread
Old 04-08-2018, 12:27 AM   #1
pedros
Member
 
Registered: May 2017
Posts: 85

Rep: Reputation: Disabled
How to undo rm -rd? How to restore deleted directory?


I wanted to delete some empty directories, so I ran$
Code:
rm -rd /media/stretch/dd7315bc-11a1-4513-a838-4280179770021/create
. The entire directory "create/" is now deleted. How to restore it?

Here is a relevant definition I found. "a file as it appears somewhere on a Linux filesystem is actually just a link to an inode, which contains all of the file's properties, such as permissions and ownership, as well as the addresses of the data blocks where the file's content is stored on disk. When you rm a file, you're removing the link that points to its inode, but not the inode itself."

Here are some things I tried. I do not understand some of the terminology.
I have debian 9.3. More details about my system are posted at pdscript.com/d9316.txt.

I unmounted /dev/sdb1, then
#
Code:
extundelete --restore-directory /media/stretch/dd7315bc-11a1-4513-a838-4280179770021/create /dev/sdb1
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 7453 groups loaded.
Loading journal descriptors ... 0 descriptors loaded.
extundelete: Illegal doubly indirect block found while finding inode for media
Failed to restore file /media/stretch/dd7315bc-11a1-4513-a838-4280179770021/create
Could not find correct inode number past inode 2.
Try altering the filename to one of the entries listed below.
File name | Inode number | Deleted status
extundelete: Operation not permitted while restoring directory.
extundelete: Operation not permitted when trying to examine filesystem

#
Code:
fsck /dev/sdb1
fsck from util-linux 2.29.2
e2fsck 1.43.4 (31-Jan-2017)
/dev/sdb1: clean, 138205/61054976 files, 119587481/244190208 blocks

#
Code:
lsof /dev/sdb1
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
Output information may be incomplete.
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
extundele 7581 root 3r BLK 8,17 0t0 1425 /dev/sdb1

According to the documentation, The following do not seem to be relavant. Some only restore limited file types.

scalpel. DESCRIPTION. Recover files from a disk image or raw block device based on headers and footers specified by the user. The default configuration file has all supported file patterns commented out. /etc/scalpel/scalpel.conf

foremost - Recover files using their headers, footers, and data structures.
#
Code:
foremost -i /media/stretch/dd7315bc-11a1-4513-a838-4280179770021/create -o /media/stretch/dd7315bc-11a1-4513-a838-4280179770021/create4
Processing: stdin
|

When I try to close terminal running foremost, message says "
there is still a process running in this terminal. closing the terminal will kill it."

testdisk - Scan and repair disk partitions. It can undelete files from Linux ext2.

testdisk.log says "To repair the filesystem using alternate superblock, run"#
Code:
fsck.ext4 -p -b superblock -B blocksize device
 
Old 04-08-2018, 03:12 AM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
Quote:
Originally Posted by pedros View Post
How to restore it?
From the periodical backups you make.

*Especially since you have been trying to fsck up your system even more in the process. Next time if unsure please ask before you do stuff, because not ensuring nothing gets written after the mistake, not making a (dd) clone beforehand and even worse: trying to write recovery data to the same partition, will result in nothing but Wailing and Gnashing of Teeth.
 
Old 04-08-2018, 03:22 AM   #3
Turbocapitalist
LQ Guru
 
Registered: Apr 2005
Distribution: Linux Mint, Devuan, OpenBSD
Posts: 5,562
Blog Entries: 3

Rep: Reputation: 2840Reputation: 2840Reputation: 2840Reputation: 2840Reputation: 2840Reputation: 2840Reputation: 2840Reputation: 2840Reputation: 2840Reputation: 2840Reputation: 2840
Yes, restoring from the backup you make is the usual way. You can automate incremental backups using rsync and its "link-dest" option.

Otherwise, if you have a little bit of extra RAM you might look into using OpenZFS instead of EXT4 for your file system on your data partition(s). OpenZFS has a very easy to use snapshot feature as well as a bookmark capability. That makes it very easy to roll back changes, such as an overly vigorous deletion. If I understand correctly that is in part a side effect of its copy-on-write nature. However, even with snapshots, OpenZFS in and of itself is not a substitute for adequate backups.
 
Old 04-09-2018, 09:01 PM   #4
sntnlz
Member
 
Registered: Jun 2005
Location: Virginia, USA
Distribution: Mageia/Kali/Ubuntu/openSUSE/Manjaro/Pop!_OS
Posts: 39

Rep: Reputation: 18
As Turbocapitalist said, first and foremost, when you delete anything that you might want to recover later, you should never have the same drive that you wish to recover data from as the destination drive for recovery. Think of it as you would text that you write with a pencil on a sheet of paper. If you erase that text by mistake, you can inspect the sheet of paper in different lighting conditions or try the different tactics which one could try to read something that they'd written with a pencil and then erased. However, if you try to read the old text while writing on that sheet of paper as you look for erased text, you will make it very hard and eventually not possible to find any of your old text because it has been made illegible by the new text that you wrote. The sheet of paper is your hard drive and the tactics that you use to read erased pencil writing are the software tools that you run to recover erased data. So it is crucial that you start right to have a better rate of success at bringing back your erased data. The definition of deletion that you mentioned at the beginning of your post also means that when the link is broken, the space occupied by the inode is reported as being empty space and available to write operations (it can be overwritten).

Don't run fsck in this scenario because again you risk changing your deleted data beyond complete or partial recovery. You only need to fsck a drive if you suspect something wrong with the drive or file system. But usually you will know when this happens because the system will generally complain about it.

I've had success retrieving deleted data with "testdisk", "photorec" (which isn't only used to retrieve/recover deleted image files), and "foremost" with similar rates of success under the same circumstances. On a healthy drive with a healthy file system and data that has not been overwritten by new data, the success rate for a recovery using any one of these 3 software tools is 100% or very close to 100%. You should keep in mind that these tools will recover files however, but not directory structures. So in your case, you would recover the files which were part of directory "create" and any sub-directories, but you would have to place these files back in directories. So before you try to recover your files again, get yourself an external (or another internal) drive and set it up so that you can use that drive as your recovery destination drive so as not to overwrite the data that you're trying to recover. Lower your expectations because chances are you have overwritten at least some of your data trying what you did to recover it. Also keep in mind that larger files (such as large photos, videos, and audio files) are less likely to be 100% recovered and in most cases are partially recovered due to ongoing read/write drive activity.

You sound like you're new to this, so I certainly wouldn't advise that you venture anywhere near zfs as your file system because maintaining and manipulating it requires advanced technical knowledge. Also many data recovery tools, including commercial ones, do not provide the ability to retrieve data from a damaged or lost zfs pool.

Depending on your drive size and the options that you choose with these tools, using any of the above 3 tools to recover your data might take anywhere from several minutes to a whole day or longer. So you have to be patient, and yes, you have to keep the terminal window open because these are terminal based tools and require the terminal where you started the tool to continue to run until the process is completely finished.

Last but not least, 1) make sure to have a backup drive to store a copy of your important data because you never know what can happen to your data as a result of an operator error or a physical failure (damaged drive, power surge, etc.); 2) read about the various backup tools which are out there including the ones which may be part of your OS so that you know how to work with these; and 3) read all about the recover tool that you will use before you try it so that you are executing the command the way that you have to and with the options which will provide the best chance for you to recover most of your data.

Good luck retrieving what you can of your data (onto a new or different destination drive!)
 
Old 04-10-2018, 09:25 AM   #5
AwesomeMachine
LQ Guru
 
Registered: Jan 2005
Location: USA and Italy
Distribution: Debian testing/sid; OpenSuSE; Fedora; Mint
Posts: 5,513

Rep: Reputation: 1009Reputation: 1009Reputation: 1009Reputation: 1009Reputation: 1009Reputation: 1009Reputation: 1009Reputation: 1009
Using the recovery tools correctly also helps.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] How to undo moving a directory to a file (accident!) ziphem Linux - Newbie 3 08-25-2014 05:46 PM
How to restore a deleted directory? thomas2004ch Linux - Newbie 7 09-17-2009 07:22 AM
Restore deleted "/etc/init.d" directory. Pimmy Debian 17 06-04-2008 10:21 AM
How can I restore a deleted /etc directory from installation disks? mikecoates Linux - Software 4 03-28-2006 04:31 AM
How to restore a deleted file satimis Linux - Newbie 1 09-12-2003 04:18 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Hardware

All times are GMT -5. The time now is 08:44 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration