How to restore data on /home/user accidentally removed

satimis · 11-14-2007, 08:53 PM

Hi folks,

Ubuntu 7.04 server amd64

While I login as "satimis", I accidentally ran "sudo deluser --remove-all-files satimis" removing all data and config files of "satimis". Because login, "satimis" and its home directory /home/satimis are still there after relogin. I'm trying to restore the backup. I never did it before.

googling brought me following thread;
home user backup/restore problem
http://ubuntuforums.org/showthread.php?t=546905

$ apt-cache policy dar

Code:

dar:
  Installed: (none)
  Candidate: 2.3.3-0ubuntu1
  Version table:
     2.3.3-0ubuntu1 0
        500 http://us.archive.ubuntu.com feisty/universe Packages

dar NOT installed. I'll install it later.

Please advise;

1)
Where is /path/my_archive_file? How to find it?

2)
Currently I have some working data on /home/satimis copied from another PC with "scp". Will restore overwrite those working data? If YES, can I move them to another user's home for temporary storage?

3)
Are there better solutions than that mentioned on the above thread?

TIA

B.R.
satimims

hoes · 11-15-2007, 02:48 AM

You removed the home files?
It is unlikely that you will be able to restore the data.
It looks like in the home user back-up, they had a back-up.
If you have a back-up you should restore it.
If not you're kind of screwed.
The thread about the backup restore problem assumes there is a backup and is more about extracting the files.

The data on anotther PC will most likely not be overwritten.
But this depends on how it is set up. If you just copied the files once with scp, no harm will be done overwriting. But since you have a copy you could try putting that back in your home directory.

Also, maybe there is a program that can recover remove linux data from an ext2 of ext3.

Good luck with your problem

kWzTa · 11-15-2007, 03:28 AM

Hello,

I think that by issuing "sudo deluser --remove-all-files satimis" you really deleted your files. If that's the case
"dar" won't be of much help. I do not know the command, but according to the link you gave, it sounds more like a
backup/restore program which means that unless you have a backup/archive, "dar" is useless for your problem.

One way, if you had an ext2 filesystem is to read and follow instructions of the following HOWTO which uses the
command "debugfs" :

http://tldp.org/HOWTO/Ext2fs-Undeletion.html

Basic recovery procedure can be summarized as follows:
1) use debugfs to retrieve a list of deleted inodes
2) select the inodes you wish to recover (most likely based on deletion time)
3) use debugfs to recover selected inodes
4) sort recovered inodes (maybe the most tedious step: once a file is deleted you lose its name !)

The HOWTO targets ext2 filesystem but since "debugfs" supports ext3 also, it may also work with ext3. A similar command also exists for ReiserFS: "debugreiserfs", so something similar might hold for ReiserFS.

There are surely other tools, maybe more user-friendly than this method.

Try again in Google using variations of linux recovery, linux undeletion etc.

In any case make sure you BACKUP FIRST any remaining valuable files.

HTH,

satimis · 11-16-2007, 08:27 AM

H kWzTa and hoes,

Thanks for your advice.

The filesystem is ext3.

The building of the mail server has been completed. It is now working. I found spam mails being delivered to satimis' Maildir. I have no way to stop it therefore I deleted this user. Unfortunately I forgot saving the work done in the last 7~10 days. The work are in .txt, .pdf and .jpg files. recording the steps on building the mail server, problem encountered and their solution, etc. Because login as satimis, user can't be removed but all data on its home directory deleted together with some configure files of the mail server.

TestDisk and PhotoRec may help;
http://www.cgsecurity.org/wiki/TestDisk

However it is already 2 days since the incident. Some space on the HD has already been overwritten. It has not much sense to try undeleting those data because the chance of recovery is remote. But I'll try only for learning. However I haven't figured out where to keep the recovered data.

The Recovery Steps on following document;
http://www.shawnhermans.com/how-reco...identally-repa

explains the steps as well as the storage space for recovered data. I hope to build up my knowledge in this respect through learning a bitter lesson.

B.R.
satimis