Re: undelete files

[Jochen Schulz]

Danesh Daroui:
> 
> I have deleted my "/tmp" directory by mistake.

Generally, that shouldn't be a problem, since no application should
expect to find data stored in there after a reboot anyway. Just recreate
it and do 'chmod 1777 /tmp' afterwards.

> I would like to ask if there is anyway to retrieve deleted data?

If you didn't store something important in /tmp/ yourself (which you
should avoid in the first), you don't need to recover any data.

J.
-- 
My medicine shelf is my altar.
[Agree]   [Disagree]
 


signature.asc
Description: Digital signature

undelete files

[Danesh Daroui]

Hi,

I have deleted my "/tmp" directory by mistake. Since the contents were
too large, the system was unable to save the deleted data into .trash
folder. After that, the system could not come up with this error "gdm
user doesn't exist...", so I use Live CD to login into the system.

I would like to ask if there is anyway to retrieve deleted data?

Thanks,

D.


-- 
To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Re: Undelete files [RESOLVED]

[Alejandro Aguila Sáinz]

Hi, after googling I just found the solution for my problem, actually I also
undeleted a lot of pictures that I deleted several months ago, here is the
solution (as root):

apt-get install foremost

After foremost is installed restart your system to the single user mode
(Selecting it from GRUB) , because in my case after trying two times in
regular mode I got a segment violation error, and send:

foremost -t jpg -i /dev/hda -o /home/recovery

Then reboot into regular mode and open the lauch application pop-up (alt+f2)
and send:

gksu nautilus

Then just go to /home/recovery and all your deleted JPG files are back, I
took like 20 minutes to show all the files because there was 4 GB recovered.
This foremost applications it's really cool, you can also recover a lot of
files, just check man foremost.

Thanks !


On Tue, Jul 8, 2008 at 8:46 PM, Ron Johnson <[EMAIL PROTECTED]> wrote:

> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA1
>
>
> Why do so many people top-post?
>
> On 07/08/08 20:15, Alejandro Aguila Sáinz wrote:
> > Yes, and I mounted it to another Debian system and I found the foremost
>
> Excellent.  Without doing that, you are sunk.
>
> > application, it's running right now. I don't know the results yet, so if
> > you have another option please let me know.
>
> - From Googling for "undelete ext3", I found:
> http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html<http://www.xs4all.nl/%7Ecarlo17/howto/undelete_ext3.html>
> http://code.google.com/p/ext3grep/
>
> > On Tue, Jul 8, 2008 at 8:03 PM, Ron Johnson <[EMAIL PROTECTED]
> > <mailto:[EMAIL PROTECTED]>> wrote:
> >
> > On 07/08/08 19:45, Alejandro Aguila Sáinz wrote:
> >> Hi! Today I just deleted a directory by mistake, it went to the trash,
> >> so when I draged it back to my personal directory by mistake again I
> >> cancelled the process, and now the directory is gone, do you know if
> >> there's a way to get it back? Thanks!!!
> >
> > Did you unmount the device as soon as the incident occurred?
>
> - --
> Ron Johnson, Jr.
> Jefferson LA  USA
>
> "Kittens give Morbo gas.  In lighter news, the city of New New
> York is doomed."
> -BEGIN PGP SIGNATURE-
> Version: GnuPG v1.4.9 (GNU/Linux)
>
> iEYEARECAAYFAkh0GGAACgkQS9HxQb37XmezuQCfYcgrkfWbG36WGYOHlgWbXjMh
> v/sAnA3EngGjcK4SjKA6J8YPJIxiB63X
> =r44V
> -END PGP SIGNATURE-
>



-- 
Alejandro Aguila Sáinz <[EMAIL PROTECTED]>
PGP KEY: 14D45A26
Fingerprint: 9670 F4A3 0568 42AF DF1A 2429 C1D3 D6A6 14D4 5A26

Re: Undelete files

[Ron Johnson]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On 07/08/08 19:45, Alejandro Aguila Sáinz wrote:
> Hi! Today I just deleted a directory by mistake, it went to the trash,
> so when I draged it back to my personal directory by mistake again I
> cancelled the process, and now the directory is gone, do you know if
> there's a way to get it back? Thanks!!!

Did you unmount the device as soon as the incident occurred?

- --
Ron Johnson, Jr.
Jefferson LA  USA

"Kittens give Morbo gas.  In lighter news, the city of New New
York is doomed."
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkh0DmgACgkQS9HxQb37XmfESACdEv14fI/puHl9XLk2L/qlDXie
GBYAoOoraCSZoG29o1Au3gDHzpQKY/XH
=kqed
-END PGP SIGNATURE-


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Undelete files

[Alejandro Aguila Sáinz]

Hi! Today I just deleted a directory by mistake, it went to the trash, so
when I draged it back to my personal directory by mistake again I cancelled
the process, and now the directory is gone, do you know if there's a way to
get it back? Thanks!!!

-- 
Alejandro Aguila Sáinz <[EMAIL PROTECTED]>
PGP KEY: 14D45A26
Fingerprint: 9670 F4A3 0568 42AF DF1A 2429 C1D3 D6A6 14D4 5A26

Re: undelete from XFS

[Håkon Alstadheim]

Roberto C. Sanchez wrote:
> On Tue, Mar 06, 2007 at 02:56:48AM +0530, Siju George wrote:
>   
>> yes the sad fact is there is no undelete for XFS! - is it so?
>>
>> restoring from backup then :-(
>>
>> 
> Yep.  A recent backup is your only hope, unless you want to spend
> thousands of dollars on a data recovery service, which may or may not
> recover your data.
>
> Regards,
>
>   
(only half-joking):
dd if=/dev/ | strings | lpr

Be ready with lots of paper. Get out scissors and glue. Invite all the
puzzle buffs you know over, offer pizza and prizes to whoever finds the
data you need.

You might want to spend some time working on that command-line before
you commit to spending all that money on paper, glue, pizza and whatever.

If any of the data you are after was encrypted, or even just zipped, or
even in MS-Word format, you might want to give up right away.

-- 
Håkon Alstadheim 
spamtrap: [EMAIL PROTECTED] -- 1 hit & you are out


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: undelete from XFS

[Roberto C. Sanchez]

On Tue, Mar 06, 2007 at 02:56:48AM +0530, Siju George wrote:
> yes the sad fact is there is no undelete for XFS! - is it so?
> 
> restoring from backup then :-(
> 
Yep.  A recent backup is your only hope, unless you want to spend
thousands of dollars on a data recovery service, which may or may not
recover your data.

Regards,

-Roberto
-- 
Roberto C. Sanchez
http://people.connexer.com/~roberto
http://www.connexer.com


signature.asc
Description: Digital signature

Re: undelete from XFS

[Siju George]

yes the sad fact is there is no undelete for XFS! - is it so?

restoring from backup then :-(

Thankyou so much :-)

--Siju

On 3/6/07, Siju George <[EMAIL PROTECTED]> wrote:

Hi,

I just rm -rf some stuff from XFS filesystem :-(

is there any way to undelete?

Thankyou so much
kindRegards

Siju




--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

undelete from XFS

[Siju George]

Hi,

I just rm -rf some stuff from XFS filesystem :-(

is there any way to undelete?

Thankyou so much
kindRegards

Siju


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: How do I undelete a file in GNU/Linux or UNIX?

[Paul Johnson]

Glen Yu wrote:

> If I accidentally deleted a file in any GNU/Linux or Unix-based OS, is
> there anyway I can recover those files?

The good news is the file can be recovered in exactly the same way as you do
in windows:  Restore the file from a recent backup.

The bad news is you need to have a backup handy.  External firewire hard
drives of massive capacity are getting inexpensive, and faubackup can
handle nightly backups like a champ.



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: How do I undelete a file in GNU/Linux or UNIX?

[Ottavio Caruso]

--- Glen Yu <[EMAIL PROTECTED]> wrote:

> Hi everyone,
> 
> If I accidentally deleted a file in any GNU/Linux or Unix-based OS,
> is there
> anyway I can recover those files?

Usually, there isn't. On 'BSD hacks' there is a handy shell script 
that will backup deleted files to a hidden .trash directory. You will

find it on Google.

-- 
Ottavio Caruso

I will not purchase any computing equipment from manufacturers that recommend 
Windows Vista™ or any other Microsoft® products.
http://www.pledgebank.com/boycottvista


 

Cheap talk?
Check out Yahoo! Messenger's low PC-to-Phone call rates.
http://voice.yahoo.com


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: How do I undelete a file in GNU/Linux or UNIX?

[Glen Yu]

I was hoping there was some way to resolve it without having to contact the
admins =P, but I guess there's just no other choice huh?

Anyway, thanks for your input.


Cheers,
-Glen



On 1/31/07, Ron Johnson <[EMAIL PROTECTED]> wrote:


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On 01/31/07 11:00, Glen Yu wrote:
> Hi everyone,
>
> If I accidentally deleted a file in any GNU/Linux or Unix-based OS, is
> there
> anyway I can recover those files?

If you are using the ext2 filesystem and pulled the plug
immediately, there's a slim chance.

Otherwise, restore from backup.

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFFwMzaS9HxQb37XmcRAqGoAKDJcrYVwriFRn+BD1+uKuZE5rz2iQCaArCI
6iHzoqzGh2GWildQr6Zg4nk=
=0Yyk
-END PGP SIGNATURE-


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact
[EMAIL PROTECTED]

Re: How do I undelete a file in GNU/Linux or UNIX?

[Ron Johnson]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On 01/31/07 11:00, Glen Yu wrote:
> Hi everyone,
> 
> If I accidentally deleted a file in any GNU/Linux or Unix-based OS, is
> there
> anyway I can recover those files?

If you are using the ext2 filesystem and pulled the plug
immediately, there's a slim chance.

Otherwise, restore from backup.

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFFwMzaS9HxQb37XmcRAqGoAKDJcrYVwriFRn+BD1+uKuZE5rz2iQCaArCI
6iHzoqzGh2GWildQr6Zg4nk=
=0Yyk
-END PGP SIGNATURE-


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: How do I undelete a file in GNU/Linux or UNIX?

[Roberto C. Sanchez]

On Wed, Jan 31, 2007 at 01:00:35PM -0400, Glen Yu wrote:
> Hi everyone,
> 
> If I accidentally deleted a file in any GNU/Linux or Unix-based OS, is there
> anyway I can recover those files?
> 
This was recently discussed.  The answers are:

1) from a recent backup
2) if you are using a non-journaling FS, Google may turn up some info

Regards,

-Roberto

-- 
Roberto C. Sanchez
http://people.connexer.com/~roberto
http://www.connexer.com


signature.asc
Description: Digital signature

How do I undelete a file in GNU/Linux or UNIX?

[Glen Yu]

Hi everyone,

If I accidentally deleted a file in any GNU/Linux or Unix-based OS, is there
anyway I can recover those files?


Cheers,
-Glen

Re: undelete

[Nyizsnyik Ferenc]

On Tue, 2007-01-23 at 19:00 +, andy wrote:
> Tony Heal wrote: 
> > OK, how about some preventative stuff. If there is not real way to
> > 'undelete' files. How about adding a script named 'rm' that passes the same
> > switches to from the script to /bin/rm but moves the files to tmp before
> > deleting them.
> > 
> > Anyone have something like this hanging around their system somewhere?
> > 
> > Tony
> > 
> > -Original Message-
> > From: Ron Johnson [mailto:[EMAIL PROTECTED] 
> > Sent: Tuesday, January 23, 2007 12:34 PM
> > To: debian-user@lists.debian.org
> > Subject: Re: undelete
> > 
> > -BEGIN PGP SIGNED MESSAGE-
> > Hash: SHA1
> > 
> > On 01/23/07 10:37, Tony Heal wrote:
> >   
> > > Is there a way to recover deleted files?
> > > 
> > 
> > Maybe, if you are using FAT (highly unlikely) or ext2 (also highly
> > unlikely) and you pulled the plug as soon as you noticed what you did.
> > 
> > Sadly, the standard answer, though, is, "No, you're SOL."
> > 
> > -BEGIN PGP SIGNATURE-
> > Version: GnuPG v1.4.6 (GNU/Linux)
> > 
> > iD8DBQFFtkcRS9HxQb37XmcRAqhnAKDNyhcPxKrAPAZROeuWy17vcXm8+QCgmawR
> > ll/LxgpYoAHbF685Mc2yXK8=
> > =5K+z
> > -END PGP SIGNATURE-
> > 
> > 
> >   
> You could always create an alias and make rm interactive by inserting
> the -i option, hence rm would now become rm -i which would at least
> make you think twice before actually deleting it?
> 
> A

Or keep a file named
-i
in very important directories, and when you issue
rm *
hopefully rm will interpret it as an argument.
However, this is not very nice. We are clever enough to use Linux -
careless clicking costs files. :)

-- 
Szia:
Nyizsa.

--
Click to compare rates on health insurance, save big, shop here:
http://tags.bluebottle.com/fc/CAaCMPJkqMSVt23XZEnJ2RQJGjgtcv2F/


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: undelete

[Andy Smith]

On Tue, Jan 23, 2007 at 01:44:17PM -0500, Tony Heal wrote:
> OK, how about some preventative stuff. If there is not real way to
> 'undelete' files. How about adding a script named 'rm' that passes the same
> switches to from the script to /bin/rm but moves the files to tmp before
> deleting them.

I prefer to have working and tested backups.

-- 
http://bitfolk.com/ -- No-nonsense VPS hosting
Encrypted mail welcome - keyid 0x604DE5DB


signature.asc
Description: Digital signature

Re: undelete

[Paul Johnson]

Tony Heal wrote:

> Is there a way to recover deleted files?

Restore it from your backup media.  Failing that, it's gone (think twice,
delete once).  Better get yourself a nice firewire external hard drive of
incredible size and start using faubackup before it happens again.



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: RE: undelete

[Roberto C. Sanchez]

On Tue, Jan 23, 2007 at 04:46:17PM -0500, Angelo Bertolli wrote:
> 
> #!/bin/bash
> 
> mv $@ ~/.Trash
> 
Hmm.  There are some problems here:

[EMAIL PROTECTED]:~$ which rm
/home/roberto/bin/rm
[EMAIL PROTECTED]:~$ touch test
[EMAIL PROTECTED]:~$ rm test 
[EMAIL PROTECTED]:~$ ls .Trash/
test
[EMAIL PROTECTED]:~$ touch test
[EMAIL PROTECTED]:~$ rm test 
mv: overwrite `/home/roberto/.Trash/test'? y
[EMAIL PROTECTED]:~$ touch test
[EMAIL PROTECTED]:~$ rm -f test 
[EMAIL PROTECTED]:~$ ls .Trash/
test
[EMAIL PROTECTED]:~$ mkdir testdir
[EMAIL PROTECTED]:~$ touch testdir/test
[EMAIL PROTECTED]:~$ rm -r testdir/
mv: invalid option -- r
Try `mv --help' for more information.
[EMAIL PROTECTED]:~$ touch test2
[EMAIL PROTECTED]:~$ rm -- test2
[EMAIL PROTECTED]:~$ ls .Trash/
test  test2

I'd say it needs some more smarts.

> exit 0
> 
This is universally bad.  You are declaring here that no matter the exit
code of the mv command, this script will exit successfully.  You should
generally exit with something like $? to make sure that the exit code
gets passed to the calling shell.

Regards,

-Roberto

-- 
Roberto C. Sanchez
http://people.connexer.com/~roberto
http://www.connexer.com


signature.asc
Description: Digital signature

Re: RE: undelete

[Angelo Bertolli]

Tony Heal wrote:

OK, how about some preventative stuff. If there is not real way to
'undelete' files. How about adding a script named 'rm' that passes the same
switches to from the script to /bin/rm but moves the files to tmp before
deleting them.

Anyone have something like this hanging around their system somewhere?
  


How about making sure you have a directory called ~/.Trash and then 
making a script like...


#!/bin/bash

mv $@ ~/.Trash

exit 0

And then... put this in ~/bin/rm

And then

alias rm="~/bin/rm"

to make sure you use that one

(Or make sure ~/bin is first in your path, or just call 
/home/user/bin/rm explicitly.)


Angelo


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: undelete

[Mike McCarty]

Andrew Sackville-West wrote:

On Tue, Jan 23, 2007 at 11:25:21AM -0900, Ken Irving wrote:


On Tue, Jan 23, 2007 at 11:32:31AM -0800, Andrew Sackville-West wrote:


On Tue, Jan 23, 2007 at 02:06:02PM -0500, Tony Heal wrote:


OK, how about some preventative stuff. If there is not real way to
'undelete' files. How about adding a script named 'rm' that passes the same
switches to from the script to /bin/rm but moves the files to tmp before
deleting them.


I don't have one, but it would be trivial to write a bash script that
takes an rm   and turns it into a mv 
/tmp/trash. simply alias rm to that script in bashrc et al. or, if you
wanted system-wide "Trashing" you could mv the rm binary out of the
way and symlink to your script. the implications of that could be huge
though.


Something like this *might* work, but is off-the-cuff, not tested:



[snip]



sorta works but bombs if .trash doesn't exist, or if rm switches are
used (eg. -rf). hows this



[snip]




A real danger in using this sort of crutch is that you'll get nailed if
you rely on it, assume it's there, and then end up using the native rm
without knowing it.  The same goes for alias rm='rm -i'.

IMHO the best approach is to realize the nature of the system you're
working with, learn to use the native commands, and set up a decent
backup system.


Another approach is that mentioned in

http://www.mikerubel.org/computers/rsync_snapshots/

Look for "Extensions: hourly, daily, and weekly snapshots"

One can create a directory ~/.snapshot with subdirectories
like hourly.1, hourly.2, daily, monthly, etc.

If you delete a file, then a copy which is at most one hour
old will be in ~/.snapshot/hourly.1

The technique described does not eat enormous amounts of disc,
either.

Mike
--
p="p=%c%s%c;main(){printf(p,34,p,34);}";main(){printf(p,34,p,34);}
This message made from 100% recycled bits.
You have found the bank of Larn.
I can explain it for you, but I can't understand it for you.
I speak only for myself, and I am unanimous in that!


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: undelete

[Andrew Sackville-West]

On Tue, Jan 23, 2007 at 11:25:21AM -0900, Ken Irving wrote:
> On Tue, Jan 23, 2007 at 11:32:31AM -0800, Andrew Sackville-West wrote:
> > On Tue, Jan 23, 2007 at 02:06:02PM -0500, Tony Heal wrote:
> > > OK, how about some preventative stuff. If there is not real way to
> > > 'undelete' files. How about adding a script named 'rm' that passes the 
> > > same
> > > switches to from the script to /bin/rm but moves the files to tmp before
> > > deleting them.
> > 
> > I don't have one, but it would be trivial to write a bash script that
> > takes an rm   and turns it into a mv 
> > /tmp/trash. simply alias rm to that script in bashrc et al. or, if you
> > wanted system-wide "Trashing" you could mv the rm binary out of the
> > way and symlink to your script. the implications of that could be huge
> > though.
> 
> Something like this *might* work, but is off-the-cuff, not tested:
> 
> $ cat ~/bin/rm2trash
> #!/bin/sh
> TRASH=~/.trash
> for f in $*; do
> echo TEST of $0:
> echo cp -pf "$f" "$TRASH/$f"
> echo rm "$f"
> done
> ... make it executable, alias the rm command to run it, e.g.,
> 
> $ chmod +x ~/bin/rm2trash
> $ alias rm=rm2trash

sorta works but bombs if .trash doesn't exist, or if rm switches are
used (eg. -rf). hows this

[EMAIL PROTECTED]:~$ cat rm2trash
#!/bin/bash
TRASH=~/.trash

if [ ! -e $TRASH ]; then
mkdir $TRASH
fi

for f in $*; do
if [ -e $f ]; then
cp -pf "$f" "$TRASH/$f"
rm "$f"
else
echo $f does not exist, skipping.
fi
done

> 
> A real danger in using this sort of crutch is that you'll get nailed if
> you rely on it, assume it's there, and then end up using the native rm
> without knowing it.  The same goes for alias rm='rm -i'.
> 
> IMHO the best approach is to realize the nature of the system you're
> working with, learn to use the native commands, and set up a decent
> backup system.

you are correct sir!

A



signature.asc
Description: Digital signature

Re: undelete

[Ken Irving]

On Tue, Jan 23, 2007 at 11:32:31AM -0800, Andrew Sackville-West wrote:
> On Tue, Jan 23, 2007 at 02:06:02PM -0500, Tony Heal wrote:
> > OK, how about some preventative stuff. If there is not real way to
> > 'undelete' files. How about adding a script named 'rm' that passes the same
> > switches to from the script to /bin/rm but moves the files to tmp before
> > deleting them.
> 
> I don't have one, but it would be trivial to write a bash script that
> takes an rm   and turns it into a mv 
> /tmp/trash. simply alias rm to that script in bashrc et al. or, if you
> wanted system-wide "Trashing" you could mv the rm binary out of the
> way and symlink to your script. the implications of that could be huge
> though.

Something like this *might* work, but is off-the-cuff, not tested:

$ cat ~/bin/rm2trash
#!/bin/sh
TRASH=~/.trash
for f in $*; do
echo TEST of $0:
echo cp -pf "$f" "$TRASH/$f"
echo rm "$f"
done

... make it executable, alias the rm command to run it, e.g.,

$ chmod +x ~/bin/rm2trash
$ alias rm=rm2trash

and *maybe* it would work.  Remove the 'echo' commands if the output
looks ok.  (Note that it would be best to store options from the command
line to pass along to the inner rm, along with other niceties.)

A real danger in using this sort of crutch is that you'll get nailed if
you rely on it, assume it's there, and then end up using the native rm
without knowing it.  The same goes for alias rm='rm -i'.

IMHO the best approach is to realize the nature of the system you're
working with, learn to use the native commands, and set up a decent
backup system.

For backups, I use and would recommend the rsnapshot package, which
uses rsync to efficiently create copies of filesystems.  This might
normally be done to a networked backup server, but can also run on a
single machine.  Lots of other schemes are available, using rsync and
otherwise.

Ken

-- 
Ken Irving, [EMAIL PROTECTED]


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: undelete

[Andrew Sackville-West]

On Tue, Jan 23, 2007 at 02:06:02PM -0500, Tony Heal wrote:
> That does not work to well in an automated script, but thanks
> 

what doesn't? oh, top-posting. please don't do that.

>  
> 
> Tony Heal wrote: 
> 
> OK, how about some preventative stuff. If there is not real way to
> 'undelete' files. How about adding a script named 'rm' that passes the same
> switches to from the script to /bin/rm but moves the files to tmp before
> deleting them.
>  

I don't have one, but it would be trivial to write a bash script that
takes an rm   and turns it into a mv 
/tmp/trash. simply alias rm to that script in bashrc et al. or, if you
wanted system-wide "Trashing" you could mv the rm binary out of the
way and symlink to your script. the implications of that could be huge
though.

A

>  
> -Original Message-
> From: Ron Johnson [mailto:[EMAIL PROTECTED] 
> Sent: Tuesday, January 23, 2007 12:34 PM
> To: debian-user@lists.debian.org
> Subject: Re: undelete
>  
> On 01/23/07 10:37, Tony Heal wrote:
>   
> 
> Is there a way to recover deleted files?
> 
> 
>  
> Maybe, if you are using FAT (highly unlikely) or ext2 (also highly
> unlikely) and you pulled the plug as soon as you noticed what you did.
>  
> Sadly, the standard answer, though, is, "No, you're SOL."
>  
>  
>  
>   
> 
> You could always create an alias and make rm interactive by inserting the -i
> option, hence rm would now become rm -i which would at least make you think
> twice before actually deleting it?
> 
> A
> 


signature.asc
Description: Digital signature

Re: undelete

[Ron Johnson]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

You could probably write a perl or python script (call it "safe_rm")
that traps the input parameters and does a fancy mv, echoing the
fully qualified file name into either ~/.trash (if run by an
unprivileged user, or /trash if by root.

Sadly, this will only save files that you delete from the CLI.  To
be universal, such a trash feature would have to be implemented
either in the OS (a highly unlikely prospect) or within the libc
ulink() function.  (Also highly unlikely, but much more portable
than changing every OS that libc runs on.)

On 01/23/07 12:44, Tony Heal wrote:
> OK, how about some preventative stuff. If there is not real way to
> 'undelete' files. How about adding a script named 'rm' that passes the same
> switches to from the script to /bin/rm but moves the files to tmp before
> deleting them.
> 
> Anyone have something like this hanging around their system somewhere?
> 
> Tony
> 
> -Original Message-
> From: Ron Johnson [mailto:[EMAIL PROTECTED] 
> Sent: Tuesday, January 23, 2007 12:34 PM
> To: debian-user@lists.debian.org
> Subject: Re: undelete
> 
> On 01/23/07 10:37, Tony Heal wrote:
>> Is there a way to recover deleted files?
> 
> Maybe, if you are using FAT (highly unlikely) or ext2 (also highly
> unlikely) and you pulled the plug as soon as you noticed what you did.
> 
> Sadly, the standard answer, though, is, "No, you're SOL."
> 
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFFtmH5S9HxQb37XmcRArgjAJ9j32V43WpcgQRy8/L/lu3RdaAjbACfWtW5
RCP8vph0/rrqE9RgUkD1PFY=
=l8Q0
-END PGP SIGNATURE-


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: undelete

[Roberto C. Sanchez]

On Tue, Jan 23, 2007 at 11:37:51AM -0500, Tony Heal wrote:
> Is there a way to recover deleted files?
> 
Yes.  From a recent backup.

Regards,

-Roberto

-- 
Roberto C. Sanchez
http://people.connexer.com/~roberto
http://www.connexer.com


signature.asc
Description: Digital signature

RE: undelete

[Sven Arvidsson]

On Tue, 2007-01-23 at 13:44 -0500, Tony Heal wrote:
> OK, how about some preventative stuff. If there is not real way to
> 'undelete' files. How about adding a script named 'rm' that passes the same
> switches to from the script to /bin/rm but moves the files to tmp before
> deleting them.
> 
> Anyone have something like this hanging around their system somewhere?

I think you want libtrash, from the description:

 "libtrash is a shared library which, when preloaded,
 implements a trash can under GNU/Linux. This way, your
 mistakes (at least those of the "rm -rf dir /" class :-))
 will no longer cause the loss of a week's work or your
 system's binaries."

However, I believe it broke some stuff or misbehaved in other ways. I
can't remember exactly but Google can probably dig up som criticisms. 

-- 
Cheers,
Sven Arvidsson
http://www.whiz.se
PGP Key ID 760BDD22


signature.asc
Description: This is a digitally signed message part

RE: undelete

[Tony Heal]

That does not work to well in an automated script, but thanks

 

Tony

 

  _  

From: andy [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, January 23, 2007 2:00 PM
To: debian-user@lists.debian.org
Subject: Re: undelete

 

Tony Heal wrote: 

OK, how about some preventative stuff. If there is not real way to
'undelete' files. How about adding a script named 'rm' that passes the same
switches to from the script to /bin/rm but moves the files to tmp before
deleting them.
 
Anyone have something like this hanging around their system somewhere?
 
Tony
 
-Original Message-
From: Ron Johnson [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, January 23, 2007 12:34 PM
To: debian-user@lists.debian.org
Subject: Re: undelete
 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
 
On 01/23/07 10:37, Tony Heal wrote:
  

Is there a way to recover deleted files?


 
Maybe, if you are using FAT (highly unlikely) or ext2 (also highly
unlikely) and you pulled the plug as soon as you noticed what you did.
 
Sadly, the standard answer, though, is, "No, you're SOL."
 
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.6 (GNU/Linux)
 
iD8DBQFFtkcRS9HxQb37XmcRAqhnAKDNyhcPxKrAPAZROeuWy17vcXm8+QCgmawR
ll/LxgpYoAHbF685Mc2yXK8=
=5K+z
-END PGP SIGNATURE-
 
 
  

You could always create an alias and make rm interactive by inserting the -i
option, hence rm would now become rm -i which would at least make you think
twice before actually deleting it?

A

Re: undelete

[andy]

Tony Heal wrote:

OK, how about some preventative stuff. If there is not real way to
'undelete' files. How about adding a script named 'rm' that passes the same
switches to from the script to /bin/rm but moves the files to tmp before
deleting them.

Anyone have something like this hanging around their system somewhere?

Tony

-Original Message-
From: Ron Johnson [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, January 23, 2007 12:34 PM

To: debian-user@lists.debian.org
Subject: Re: undelete

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On 01/23/07 10:37, Tony Heal wrote:
  

Is there a way to recover deleted files?



Maybe, if you are using FAT (highly unlikely) or ext2 (also highly
unlikely) and you pulled the plug as soon as you noticed what you did.

Sadly, the standard answer, though, is, "No, you're SOL."

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFFtkcRS9HxQb37XmcRAqhnAKDNyhcPxKrAPAZROeuWy17vcXm8+QCgmawR
ll/LxgpYoAHbF685Mc2yXK8=
=5K+z
-END PGP SIGNATURE-


  
You could always create an alias and make rm interactive by inserting 
the -i option, hence rm would now become rm -i which would at least make 
you think twice before actually deleting it?


A

RE: undelete

[Tony Heal]

OK, how about some preventative stuff. If there is not real way to
'undelete' files. How about adding a script named 'rm' that passes the same
switches to from the script to /bin/rm but moves the files to tmp before
deleting them.

Anyone have something like this hanging around their system somewhere?

Tony

-Original Message-
From: Ron Johnson [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, January 23, 2007 12:34 PM
To: debian-user@lists.debian.org
Subject: Re: undelete

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On 01/23/07 10:37, Tony Heal wrote:
> Is there a way to recover deleted files?

Maybe, if you are using FAT (highly unlikely) or ext2 (also highly
unlikely) and you pulled the plug as soon as you noticed what you did.

Sadly, the standard answer, though, is, "No, you're SOL."

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFFtkcRS9HxQb37XmcRAqhnAKDNyhcPxKrAPAZROeuWy17vcXm8+QCgmawR
ll/LxgpYoAHbF685Mc2yXK8=
=5K+z
-END PGP SIGNATURE-


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact
[EMAIL PROTECTED]


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: undelete

[Ron Johnson]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On 01/23/07 10:37, Tony Heal wrote:
> Is there a way to recover deleted files?

Maybe, if you are using FAT (highly unlikely) or ext2 (also highly
unlikely) and you pulled the plug as soon as you noticed what you did.

Sadly, the standard answer, though, is, "No, you're SOL."

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFFtkcRS9HxQb37XmcRAqhnAKDNyhcPxKrAPAZROeuWy17vcXm8+QCgmawR
ll/LxgpYoAHbF685Mc2yXK8=
=5K+z
-END PGP SIGNATURE-


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: undelete

[Hugo Vanwoerkom]

Tony Heal wrote:

Is there a way to recover deleted files?

 


Tony



Yes, but as they said, not if you are still using the same computer.

Hugo


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: undelete

[Nelson Castillo]

Is there a way to recover deleted files?


Yes.

1) Shut down the computer.
2) Ask a more specific question.

--
http://arhuaco.org
http://emQbit.com


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: undelete

[Sergio Cuéllar Valdés]

2007/1/23, Tony Heal <[EMAIL PROTECTED]>:

Is there a way to recover deleted files?
Tony


Forensic Analysis. There are some tools that could help to recover
deleted files, like the coroners toolkit or sleuthkit/autopsy.

http://www.honeynet.org is a good place to learn something about it.

http://www.sleuthkit.org/

Best regards,
Sergio


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

undelete

[Tony Heal]

Is there a way to recover deleted files?

 

Tony

Re: UNdelete ???

[Mike McCarty]

Raquel wrote:


I have a server that I totally messed up because I did something
really stupid.  It was back up and running within about 4 hours. 
Since then I've been working on backing up more and better/smarter. 




You might consider something like this for the future...
http://www.mikerubel.org/computers/rsync_snapshots/

Mike
--
p="p=%c%s%c;main(){printf(p,34,p,34);}";main(){printf(p,34,p,34);}
This message made from 100% recycled bits.
You have found the bank of Larn.
I can explain it for you, but I can't understand it for you.
I speak only for myself, and I am unanimous in that!


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: UNdelete ???

[Cameron Hutchison]

>> Which filesystem?

>I am using ext3. I do not understand why this matters.

How a filesystem manages its unallocated space is up to it - there is no
specification for this. This is one reason people say you do not need to
defragment ext2/3 filesystems - because they are clever about how they
lay out the disk.

When you delete a file, the space it occupied becomes unallocated,
available for reallocation to other files as needed.

To undelete a file, you need to know the internals of the filesystem
structure to recover the contents - if it is still available at all.


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: UNdelete ???

[Mirco Piccin]

Hi!
Which filesystem?
For ext2 there are same tool for recovery delete data, also for reiser (but
here i'm not sure).
But for ext3. :-(

Re: Best file system for Disk quotas and undelete

[Siju George]

On 5/6/05, Lee Braiden <[EMAIL PROTECTED]> wrote:
> On Friday 06 May 2005 10:33, Siju George wrote:
> 
> > ext2? ext3? ReiserFS? JFS?
> 
> Personally, I prefer XFS.  ReiserFS is a good choice too, but I still have
> stability concerns regarding Reiser.
> 

one more quick question please :-)

if I run the Debian on XFS and if the system reboots suddenly due to a
power outage ( we have UPS but it cannot handle certain kind of
fluctuation. we will be having another one soon)

will the file system recover automatically as in the case of ext3
while the system boots up again??

Thankyou

kind regards

Siju

Re: Best file system for Disk quotas and undelete

[Siju George]

Dear Lee,

sorry for the late reply :-(
there was no office for two days.


On 5/6/05, Lee Braiden <[EMAIL PROTECTED]> wrote:
> On Friday 06 May 2005 12:15, Siju George wrote:
> > actually I don't run a GUI on this machine because it is a server that
> > hosts some PHP website development.
> 
> Ahh.  What are you actually trying to prevent, then?  Accidentally deleting
> your web projects?
> 

not at all haha!!! just wanted to have an option in case something happens

> For software projects, I'd recommend getting used to a version control system
> like Subversion.  Although not intended for it, version control gives you a
> backup of your most recent working copy, along with a "timeline" of backups
> covering the entire evolution of your project.  Apart from that, it'll make
> lots of other software development issues easier :)
> 
> If you go a little further, and backup the version control's repository
> directory, you gain not only a two-level backup system, but a backup of
> everything you've ever done on a project :)
> 

Yes I'll soon implement subversion on the server :-)

> > Thanks a lot Lee for introducing Faubackup. I am going to try it. I
> > heard of another software called Bacula. How do you compare both??
> > which is better??
> 
> I haven't tried bacula personally.  I suspect it's more oriented towards
> larger installations of workstations and a central backup server, but I may
> be wrong.  There are a number of backup options, which will mainly depend on
> the scale of your backup needs, how seriously you take the backups, and your
> willingness to be involved in the backup processes themselves.
> 
> If you have multiple Debian (or Unix) machines on a secure LAN, the quickest
> way of achieving a "real" backup solution is probably to use faubackup to
> automatically backup everything to another box.
> 
> > Presently I am using Ext3 is XFS better than Ext3??
> 
> I'm no expert, but from what I've read of others' opinions, I would say so,
> yes.  Ext3 is essentially a hack of Ext2 to gain journalling, whereas XFS has
> a long and successful history in a high-end unix operating system, with
> journalling from the beginning, afaik.  To me, it's just a more professional
> filesystem.
> 
> Ext3 gets a lot of good press for exactly that: being a small change to Ext2.
> Basically, it's a simple way to get journalling if you've already setup ext2,
> rather than a good long-term solution, imho.  There are a few arguments for
> the reliability of ext3 (since it can use tested ext2 tools, etc.), but I
> think it's safe to say that XFS is more mature than ext3.  Ext3 is pretty
> slow as well, I think.
> 
> Again though, it's a matter of personal choice.  Reiser does have some
> interesting qualities too: notably speed on small files and large
> directories.
> 
> There are a few comparisons and benchmarks etc. available online, if you want
> to research your choice further.
> 
> On the other hand, if you have Ext3 now, and it works, and your projects are
> on that filesystem... well, if it ain't broke... ;)
> 
> > Will I be able to get the option to install XFS while installing from
> > the Woody 3.0r5 CD?
> > Or should I do something else to get XFS???
> 
> Sarge is almost at the point of being the new Woody, and therefore probably a
> better choice than Woody.  I'm not sure if it supports XFS out of the box,
> but if not, you should be able to find Sarge XFS installation images, which
> will set you up with XFS during install, as you're hoping.
> 

all right Lee, thanks a lot 

god luck :-)

kind regards

Siju

Re: Best file system for Disk quotas and undelete

[Lee Braiden]

On Friday 06 May 2005 12:15, Siju George wrote:
> actually I don't run a GUI on this machine because it is a server that
> hosts some PHP website development.

Ahh.  What are you actually trying to prevent, then?  Accidentally deleting 
your web projects?

For software projects, I'd recommend getting used to a version control system 
like Subversion.  Although not intended for it, version control gives you a 
backup of your most recent working copy, along with a "timeline" of backups 
covering the entire evolution of your project.  Apart from that, it'll make 
lots of other software development issues easier :)

If you go a little further, and backup the version control's repository 
directory, you gain not only a two-level backup system, but a backup of 
everything you've ever done on a project :)

> Thanks a lot Lee for introducing Faubackup. I am going to try it. I
> heard of another software called Bacula. How do you compare both??
> which is better??

I haven't tried bacula personally.  I suspect it's more oriented towards 
larger installations of workstations and a central backup server, but I may 
be wrong.  There are a number of backup options, which will mainly depend on 
the scale of your backup needs, how seriously you take the backups, and your 
willingness to be involved in the backup processes themselves.

If you have multiple Debian (or Unix) machines on a secure LAN, the quickest 
way of achieving a "real" backup solution is probably to use faubackup to 
automatically backup everything to another box.

> Presently I am using Ext3 is XFS better than Ext3??

I'm no expert, but from what I've read of others' opinions, I would say so, 
yes.  Ext3 is essentially a hack of Ext2 to gain journalling, whereas XFS has 
a long and successful history in a high-end unix operating system, with 
journalling from the beginning, afaik.  To me, it's just a more professional 
filesystem.

Ext3 gets a lot of good press for exactly that: being a small change to Ext2.  
Basically, it's a simple way to get journalling if you've already setup ext2, 
rather than a good long-term solution, imho.  There are a few arguments for 
the reliability of ext3 (since it can use tested ext2 tools, etc.), but I 
think it's safe to say that XFS is more mature than ext3.  Ext3 is pretty 
slow as well, I think.

Again though, it's a matter of personal choice.  Reiser does have some 
interesting qualities too: notably speed on small files and large 
directories.

There are a few comparisons and benchmarks etc. available online, if you want 
to research your choice further.

On the other hand, if you have Ext3 now, and it works, and your projects are 
on that filesystem... well, if it ain't broke... ;)

> Will I be able to get the option to install XFS while installing from
> the Woody 3.0r5 CD?
> Or should I do something else to get XFS???

Sarge is almost at the point of being the new Woody, and therefore probably a 
better choice than Woody.  I'm not sure if it supports XFS out of the box, 
but if not, you should be able to find Sarge XFS installation images, which 
will set you up with XFS during install, as you're hoping.

> Thanks a lot once again for your reply :-)

Glad to be of help :)

-- 
Lee.


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: Best file system for Disk quotas and undelete

[Siju George]

Thankyou so much Lee for your detailed reply.
I appreciate them very much :-)

On 5/6/05, Lee Braiden <[EMAIL PROTECTED]> wrote:
> On Friday 06 May 2005 10:33, Siju George wrote:

> 
> Undeleting files shouldn't be part of a "strategy".  At best, it's a last
> resort.  If it actually works, it's a *lucky* last resort.  A combination of
> backing up your important files (always a good idea), setting rm to be
> interactive, and/or using the recycle bin/trashcan on your desktop instead of
> a permanent deletion would be a much better way to go.
> 

actually I don't run a GUI on this machine because it is a server that
hosts some PHP website development.

> Faubackup is pretty easy, if you want a *very* low maintenance backup
> solution.  Basically, you just edit it's config file for how many snapshots
> you want to keep as backups (the last week, or the last three weeks, or every
> month in the last year, etc.), and then edit the cron script for which
> directories to backup.  You'll then get a backup directory that keeps files
> from those times.  If you delete a file, just go to the backup directory, and
> retrieve yesterday's copy.
> 

Thanks a lot Lee for introducing Faubackup. I am going to try it. I
heard of another software called Bacula. How do you compare both??
which is better??


> Most of all though: be careful! :D
> 

yes :-)

> > ext2? ext3? ReiserFS? JFS?
> 
> Personally, I prefer XFS.  ReiserFS is a good choice too, but I still have
> stability concerns regarding Reiser.
> 

Presently I am using Ext3 is XFS better than Ext3??
Will I be able to get the option to install XFS while installing from
the Woody 3.0r5 CD?
Or should I do something else to get XFS???

Thanks a lot once again for your reply :-)

kind regards

Siju

Re: Best file system for Disk quotas and undelete

[Lee Braiden]

On Friday 06 May 2005 10:33, Siju George wrote:
> 1) implementing and managing disk quotas

I think most of the mainstream filesystems support this equally well.  Not 
sure though.

> 2) easy undeleting of files

Undeleting files shouldn't be part of a "strategy".  At best, it's a last 
resort.  If it actually works, it's a *lucky* last resort.  A combination of 
backing up your important files (always a good idea), setting rm to be 
interactive, and/or using the recycle bin/trashcan on your desktop instead of 
a permanent deletion would be a much better way to go.

Faubackup is pretty easy, if you want a *very* low maintenance backup 
solution.  Basically, you just edit it's config file for how many snapshots 
you want to keep as backups (the last week, or the last three weeks, or every 
month in the last year, etc.), and then edit the cron script for which 
directories to backup.  You'll then get a backup directory that keeps files 
from those times.  If you delete a file, just go to the backup directory, and 
retrieve yesterday's copy.

If you need copies from the last five-to-thirty minutes,  and it's a text 
file, that's what editor backup files are usually for.

Most of all though: be careful! :D

> ext2? ext3? ReiserFS? JFS?

Personally, I prefer XFS.  ReiserFS is a good choice too, but I still have 
stability concerns regarding Reiser.

-- 
Lee.


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Best file system for Disk quotas and undelete

[Siju George]

Hi all,

May I know which filesystem is best for Debian woody 3.0r5 for

1) implementing and managing disk quotas

2) easy undeleting of files

ext2? ext3? ReiserFS? JFS?

Thankyou so much

kind regards

Siju

Re: ext3 undelete/recovery

[Alvin Oga]

hi ya alban

On Fri, 7 Jan 2005, Alban Browaeys wrote:

i assume the comment below is the "rm" command
 
> > > That s right. But only if it was delete
> > > in a proper way, for example with rm .

..
 
> When you rm a file, ext3 take extra steps that prevents those tools from 
> finding
> deleted data. There is still a way to undelete, grep the filesystem/partition 
> :
> grep /dev/hda1 for example, but that s a no go for most people.

as long as the data is intact, one could stitch the inode links
back together again ( with debugfs ? ) or any other tools

> http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html
> Q: How can I recover (undelete) deleted files from my ext3 partition?
> "
> In order to ensure that ext3 can safely resume an unlink after a crash, it
> actually zeros out the block pointers in the inode,

which is okay if it left the (ascii) file contents intact
and one really wanted to undelet, it might still be possible in
some cases ..

thanx for the info...

have fun
alvin


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: ext3 undelete/recovery

[Alban Browaeys]

Alvin Oga  ns.Linux-Consulting.com> writes:

> 
> On Fri, 7 Jan 2005, Alban Browaeys wrote:
> 
> > I just wanted this to be somewhere , seems it s not worst a place than any
other.
> > 
> > With ext3 you cannot undelete a file .
> 
> out of curiousity, which undelete tools did you use ??
> 
> underneath ext3 is an ext2 fs ... so i dumb/unexperienced commentary is
> that i should be able to undelete ext2 files ( esp if i turned off ext3 to
> do the undeleting ? ) 
> 
> > That s right. But only if it was delete
> > in a proper way, for example with rm .
> 

Undelete tools : recover, 
debugfs : http://www.praeclarus.demon.co.uk/tech/e2-undel/html/howto-8.html
mc: http://www.stearns.org/doc/file-recovery.v0.81.html

When you rm a file, ext3 take extra steps that prevents those tools from finding
deleted data. There is still a way to undelete, grep the filesystem/partition :
grep /dev/hda1 for example, but that s a no go for most people.

http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html
Q: How can I recover (undelete) deleted files from my ext3 partition?
"
In order to ensure that ext3 can safely resume an unlink after a crash, it
actually zeros out the block pointers in the inode, whereas
ext2 just marks these blocks as unused in the block bitmaps and marks the inode
as "deleted" and leaves the block pointers alone.

Your only hope is to "grep" for parts of your files that have been deleted and
hope for the best.
"

Alban


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: ext3 undelete/recovery

[Alvin Oga]

On Fri, 7 Jan 2005, Alban Browaeys wrote:

> I just wanted this to be somewhere , seems it s not worst a place than any 
> other.
> 
> With ext3 you cannot undelete a file .

out of curiousity, which undelete tools did you use ??

underneath ext3 is an ext2 fs ... so i dumb/unexperienced commentary is
that i should be able to undelete ext2 files ( esp if i turned off ext3 to
do the undeleting ? ) 

> That s right. But only if it was delete
> in a proper way, for example with rm .

a common way to have an "oopsie"

cp /dev/null ooppps.txt is another common [EMAIL PROTECTED]

perl { ... unlink $SomeDirectory/$someFile.doc ; } .. 

- more undelete tools
http://Linux-Sec.net/Txt/undelete.txt ( bottom of the list )

c ya
alvin



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

ext3 undelete/recovery

[Alban Browaeys]

I just wanted this to be somewhere , seems it s not worst a place than any 
other.

With ext3 you cannot undelete a file . That s right. But only if it was delete
in a proper way, for example with rm .
In case of a power failure, at reboot if the filesystem is badly broken and some
file are lost during the filesystem recovery (fsck), before mounting the
partition one can "undelete" the file deleted by fsck with the usual ext2
undelete tools.

PS: Ext3 as it syncs data and metadata to disk every two seconds, thus benign
powerfailure does not hurt it badly. 
That explains why its slower than other journalized fs which by default only
sync metadata at this rate.

Ciao
Alban


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: undelete

[sean finney]

On Mon, Mar 31, 2003 at 12:06:06AM -0500, Jeremiah Foster wrote:
> I have foolishly deleted a file I did not want to.
> It was created this morning, so it is not backed up.
> 
> is there an undelete util ?

i've definitely been in these shoes before.  it may be too late 
depending on how active your filesystem is.  here's what i'd try,
fingers crossed.

a - unmount the filesystem!!!

if it's at all possible, unmount it, stop writing to it!  you can
also remount it read-only if you must.  if you can't do that (like
if it's in /var or something), boot up from a floppy disk or knoppix
cd or something.  once you're able to do this, you can take a deep
breath, because if it's safe, it will now stay safe, and if it's
not, then it's already gone and you can't do anything about it.

b - read  up on documentation for debugfs.

when you delete a file, it's contents aren't actually deleted (that'd be
a waste of cpu and disk access), instead, the inodes for your files
are simply returned to a pool of "deleted" inodes, which may at
some point be used again for another file (after which, you're basically
SOL if you don't have 5 digits to spend and a professional cpu forensics
lab)  if you're lucky though, these inodes have remained undisturbed,
and you can get them back with debugfs.  i won't go into the details
of the program, but it comes with some good documentation and googling
should fill in the rest of the blanks.  you should be able to use it
to get a list of deleted inodes, which you can then dump to another
filesystem, which you can then grep for your precious data.


good luck...
sean


pgp0.pgp
Description: PGP signature

Re: undelete

[Robert Storey]

On Mon, 31 Mar 2003 11:40:33 +1000
"Joyce, Matthew" <[EMAIL PROTECTED]> wrote:

> 
> I have foolishly deleted a file I did not want to.
> It was created this morning, so it is not backed up.
> 
> is there an undelete util ?


Although it's too late to help you recover the data you've already deleted, you (and 
most users) would be wise to download and install Libtrash. It's a Linux trashcan, and 
unlike the ones in KDE and Gnome, it works everywhere, even from the console. You can 
find it here:

http://www.m-arriaga.net/software/libtrash/libtrash-latest.tgz

regards,
Robert


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: undelete

[Jeremiah Foster]

I have foolishly deleted a file I did not want to.
It was created this morning, so it is not backed up.

is there an undelete util ?

thanks

Matt

Matt,

There is not an "undelete" utility as you might find under a proprietary
operating system. However, if you were editing that file, in Emacs for
example, there may have been an automatic back-up made. Emacs does this
to whatever file you are editing, (unless you tell it not to,) and
creates a file of the same name that you were editing. It names it file~
(file with a tilde.) Other editors do this as well I believe. 

The file is not gone even if you deleted it, it has just been
"unlinked." This means the bits of the file are still in the file
system, you just have destroyed the pointer to it. It is now non-trivial
to retrieve it unfortunately. If you used the command shred to delete
the file it has been overwritten and even the FBI should be unable to
retrieve it.

There are ways to get the file back, but they often require advanced
knowledge and sometimes money to buy data-recovery services or software.

Cheers,

Jeremiah


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: undelete

[Seneca]

On Mon, Mar 31, 2003 at 11:40:33AM +1000, Joyce, Matthew wrote:
> I have foolishly deleted a file I did not want to.
> It was created this morning, so it is not backed up.
> 
> is there an undelete util ?

$ apt-cache search undelete
e2undel - Undelete utility for the ext2 file system
endeavour2 - File manager with builtin file previewer
gtkrecover - GUI for recover
recover - Undelete files on ext2 partitions
gmc - Midnight Commander - A powerful file manager. - Gnome version
$

-- 
Seneca
[EMAIL PROTECTED]


pgp0.pgp
Description: PGP signature

Re: undelete

[ronin2]

On Mon, 31 Mar 2003 11:40:33 +1000
"Joyce, Matthew" <[EMAIL PROTECTED]> wrote:

> 
> I have foolishly deleted a file I did not want to.
> It was created this morning, so it is not backed up.
> 
> is there an undelete util ?

"recover" undeletes files on ext2 partitions.

If you have an ext3 partition, unmount it and remount as ext2.

I don't know about undelete utilities for other filesystems.

Kevin


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

RE: undelete

[Joyce, Matthew]

I have tried 'recover'

Package: recover
Priority: optional
Section: admin
Installed-Size: 104
Maintainer: Noel Koethe <[EMAIL PROTECTED]>
Architecture: i386
Version: 1.3b-1
Depends: libc6 (>= 2.2.4-4)
Filename: pool/main/r/recover/recover_1.3b-1_i386.deb
Size: 13360
MD5sum: a6d0b77ce1ad858878f46b426490a661
Description: Undelete files on ext2 partitions
 Recover automates some steps as described in the ext2-undeletion
 howto. This means it seeks all the deleted inodes on your hard drive
 with debugfs. When all the inodes are indexed, recover asks you some
 questions about the deleted file. These questions are:
   * Hard disk device name
   * Year of deletion
   * Month of deletion
   * Weekday of deletion
   * First/Last possible day of month
   * Min/Max possible file size
   * Min/Max possible deletion hour
   * Min/Max possible deletion minute
   * User ID of the deleted file
   * A text string the file included (can be ignored)
 .
 If recover found any fitting inodes, it asks to give a directory name
 and dumps the inodes into the directory. Finally it asks you if you
 want to filter the inodes again (in case you typed some wrong
 answers).


but I get a segmentaion error.

Matt


--


> -Original Message-
> From: Joyce, Matthew 
> Sent: Monday, 31 March 2003 12:00 PM
> To: [EMAIL PROTECTED]
> Subject: undelete
> 
> 
> 
> I have foolishly deleted a file I did not want to.
> It was created this morning, so it is not backed up.
> 
> is there an undelete util ?
> 
> thanks
> 
> Matt
> 
> 
> 
> -- 
> To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
> with a subject of "unsubscribe". Trouble? Contact 
> [EMAIL PROTECTED]
> 



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

undelete

[Joyce, Matthew]

I have foolishly deleted a file I did not want to.
It was created this morning, so it is not backed up.

is there an undelete util ?

thanks

Matt



-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: Help!!! undelete for ext3fs!!!

[Petro]

On Fri, Mar 01, 2002 at 06:28:30PM -0600, Cheryl Homiak wrote:
> Well, it really is too late now, as this was my root partition and I
> couldn't unmount it immediately even if I had known what to do. I had
> already looked at Midnight commander but your additions were helpful as I
> only saw the information about undeleting from the command line. The
> information wasn't life-or-death and I learned a lot in the process. As
> for backups, I'm really sorry but i can't figure out what a MO disk is.
> Unfortunately, the only facilities I have right now for doing backup of
> any kind is the old floppy, and I probably should have had this data on
> floppy. I'd love to have a backup system, and you'll get no argument from
> me against its importance, but the reality is that I don't have one right
> now.

No, it isn't. 

For "backups" that prevent against accidental erasure of a file, do
a "man rcsintro" if you are only worried about text files, and man
cvs if you have to work with binary files. 

> This incident also points out the wisdom in having your linux system
> mounted on several partitions so that in cases like this you can unmount
> the partition immediately.
> As for the trash can, it wouldn't do any good if your hard disk breaks but
> could be an asset in momentarily slips of the fingers (or the brain) such
> as I had.

Disks don't go bad nearly as often as people have thinkos. 


-- 
Share and Enjoy. 

Re: Help!!! undelete for ext3fs!!!

[Brian Potkin]

On Sun, Mar 03, 2002 at 09:22:14PM +0100, Paul Seelig wrote:

> [EMAIL PROTECTED] (Brian Potkin) writes:
> 
> > The man page for Midnight Commander claims that undeletion is possible
> > only with an ext2 file system.  Your suggestion to explore whether it
> > would deal with ext3 is reasonable but doesn't mc use debugfs which is
> > designed for an ext2 file system?
> >  
> Writing from the perspective of an up to date Debian/unstable system
> only (i really can't be bothered with this rotten potato anymore):
> 
> debugfs is part of the e2fsprogs package which in turn is ext3-aware.

I took what the man page for mc said at face value and didn't dig any
further to look in detail at the e2fsprogs documentation.  Thanks for
the correction; it gives me some incentive to make an ext3 partition and
test how debugfs deals with deleted files on it. 
 
> > I was aware that Midnight Commander has the facility you describe so I
> > used it.  It told me it was `loading deleted files information' and was
> > still going strong after an hour.  I went to bed, dreamt of inodes, got
> > up and there it was still churning away.
> >
> Having become curious after writing my message, i tried this as well
> on an ext3 filesystem with similar effect. But i was not patient
> enough to stand the procedure for more than an hour... ;-)

This behaviour appears to be a bug in mc and has been reported in bug
report #121917.
 
> >  Now that partition only has
> > about 50M of free space so I suspect there is insufficient room to write
> > the undeleted files to it.  
> >
> Even if you wanted to, you simply couldn't and you better wouldn't,
> even if you could because you wouldn't want to use those unlinked
> inodes to be overwritten by "restoring" your files.  
> 
> The last time i succesfully undeleted using MC (almost two years ago)
> i tried this and the undeletion routine refused writing data onto the
> same partition.

A couple of hours after making this statement it struck me that writing
to an unmounted partition is not likely to succeed.

> > A way to direct the file listing somewhere
> > else would be useful.
> >  
> What should this be good for?

Not much!  Basically, I was having difficulty understanding mc's
behaviour and not having used it for this purpose before I made the
mistake of assuming it was copying the files and required room to write
them out somewhere.

Brian.

Re: Help!!! undelete for ext3fs!!!

[Paul Seelig]

[EMAIL PROTECTED] (Brian Potkin) writes:

> The man page for Midnight Commander claims that undeletion is possible
> only with an ext2 file system.  Your suggestion to explore whether it
> would deal with ext3 is reasonable but doesn't mc use debugfs which is
> designed for an ext2 file system?
>  
Writing from the perspective of an up to date Debian/unstable system
only (i really can't be bothered with this rotten potato anymore):

debugfs is part of the e2fsprogs package which in turn is ext3-aware.

> I was aware that Midnight Commander has the facility you describe so I
> used it.  It told me it was `loading deleted files information' and was
> still going strong after an hour.  I went to bed, dreamt of inodes, got
> up and there it was still churning away.
>
Having become curious after writing my message, i tried this as well
on an ext3 filesystem with similar effect. But i was not patient
enough to stand the procedure for more than an hour... ;-)

>  Now that partition only has
> about 50M of free space so I suspect there is insufficient room to write
> the undeleted files to it.  
>
Even if you wanted to, you simply couldn't and you better wouldn't,
even if you could because you wouldn't want to use those unlinked
inodes to be overwritten by "restoring" your files.  

The last time i succesfully undeleted using MC (almost two years ago)
i tried this and the undeletion routine refused writing data onto the
same partition.

> A way to direct the file listing somewhere
> else would be useful.
>  
What should this be good for?

> Imagine a lot of .deb files.  Imagine having to rename them correctly!
> The tedium involved, however, is very much offset by the pleasure of
> recovering them.
> 
I'm feeling with you. ;-)

> Eventually I used the recover package from the testing distribution.
> You can select deleted files by date and time of deletion and dump them
> to a directory on another partition.  It was also quite quick.  Having
> read about the difficulty of undeleting files on unix systems I found
> the performance of this program impressive.
> 
Thanks for the hint!  I wasn't aware about the usefulness of this! :-)

 Thanks, P. *8^)
-- 
  Paul Seelig <[EMAIL PROTECTED]> --
   African Music Archive - Institute for Ethnology and Africa Studies
   Johannes Gutenberg-University   -  Forum 6  -  55099 Mainz/Germany
 - http://ntama.uni-mainz.de --

Re: Help!!! undelete for ext3fs!!!

[Paul Seelig]

[EMAIL PROTECTED] (Cheryl Homiak) writes:

> Well, it really is too late now, as this was my root partition and I
> couldn't unmount it immediately even if I had known what to do. 
>
Maybe you could still save some fragments of the file?  or if you are
*really* lucky, the relvant inodes still have not been overwritten?

In such cases it's nice to have another Linux system on removable
media like a CD-R or similar.  This way you could have simply rebooted
from this second system and repair from there.

There is a *very* nice full Debian live system on a single CD-R which
runs directly from CD without the need of an installation called
KNOPPIX. Boots right into a full featured KDE session with full access
of hundreds of applications.

Check out "http://www.knopper.net/knoppix/"; to learn more about it.  

I use it as full featured rescue disk and installation media for new
desktop installations.

> for backups, I'm really sorry but i can't figure out what a MO disk
> is.
>
This is a magneto optical disk. It is similar to ZIP and floppy disks
in size but has capacities from 128 MB up to 2.3 GB and is virtually
undestroyable by magnetic influences, etc.  There exist 5.25" disks
and drives with capacities up to 9.1GB as well.  MO is IMHO the only
really safe way for storing any data, albeit not very widespread and
the drives tend to be quite costly.  But one can easily aquire older
models at eBay for cheaper prices.  That's what i did. I have a 5.2GB
drive from Sony and a 640MB drive from Fujitsu. ;-)

For more information, check out "http://mo.fujitsu.com/global/";,
"http://www.sony-cp.com/_E/Products/Storage/MO/rmo-s551.html";,
"http://www.sony-cp.com/_E/Products/Storage/MO/Index.html";, and
"http://www.olympus-europa.com/mo/";.

Maybe a CD-RW might be of some practical use, but what i like so much
about MO disks is that one can use them like any other file system.

> This incident also points out the wisdom in having your linux system
> mounted on several partitions so that in cases like this you can unmount
> the partition immediately.
>
Just take into account that such deep "wisdom" shouldn't force it's
cleverness upon oneself and become impractical.  The only file system
layout i'd bother about for a desktop machine would consist of only
three partions. One each for "swap space", "/" and "/home/".  Just for
private use, anything else would be only overkill.

If you don't mind reinstalling programs from Debian packages, backups
should only be made regularily from "/etc/", "/home/" and "/var/".
But restoring (and cloning!) a system from a full backup might save
quite some time in case of an actual incident.

> As for the trash can, it wouldn't do any good if your hard disk breaks but
> could be an asset in momentarily slips of the fingers (or the brain) such
> as I had.
>
Yes, in this case it might prove to be useful.  Generally, it's a good
idea *not* to trust oneself.  Therefore it's as well a bad idea to work
only as the super user.  Been there, done that, suffered from the
consequences, and, rightfully so, got no t-shirt. ;-)

 Cheers, P. *8^)
-- 
  Paul Seelig <[EMAIL PROTECTED]> --
   African Music Archive - Institute for Ethnology and Africa Studies
   Johannes Gutenberg-University   -  Forum 6  -  55099 Mainz/Germany
 - http://ntama.uni-mainz.de --

Re: Help!!! undelete for ext3fs!!!

[Brian Potkin]

On Fri, Mar 01, 2002 at 08:38:05PM +0100, Paul Seelig wrote:

> On Thu, Feb 28, 2002 at 11:42:36PM -0600, Cheryl Homiak wrote:
> 
> > I just deleted something I didn't want to delete; won't hurt my system,
> > just destroyed some important records I was keeping.
> >
> *Immediately* unmount the partition holding this data!  With
> "*immediately*" i mean *IMMEDIATELY!*, or better put, RIGHT *NOW*!
> 
> An now let's just calm down to be able to think for a minute.

A few days ago my fingers typed the command `apt-get clean'.  What my
brain intended was `apt-get autoclean'.  Fortunately, I keep package
files on a separate ext2 partition so unmounting it was quick and easy.

I realise the deleted data are replaceable but 400M+ takes a long time to
download on a modem link so I took the opportunity to have a look at how
easy or hard it was to recover the files.  If I failed to get them back
it wouldn't be disastrous but it was annoying to have made a mistake
with a command I was familiar with.
 
> > Is there any way to undelete in ext3fs?
> >
> Since this is compatible with ext2, ext2 undeletion should be
> possible.  Now you have the possibility to find out yourself and tell
> us whether this worked or not.

The man page for Midnight Commander claims that undeletion is possible
only with an ext2 file system.  Your suggestion to explore whether it
would deal with ext3 is reasonable but doesn't mc use debugfs which is
designed for an ext2 file system?
 
> There is a comfortable way for undeletion using the GNU Midnight
> Commander, "/usr/bin/mc". If you have it installed, then start it up,
> press "F9" and choose "Command | Undelete files (ext2fs only)".  
> 
> Enter the device file name without the leading "/dev/" of the
> (hopefully unmounted!)  partition containing the deleted files and
> wait a few minutes until the panel contains a listing of deleted
> files. Depending on size of the partition in question, this can take
> up a considerable amount of time. So please be patient even if this
> takes half an hour or even far more.

I was aware that Midnight Commander has the facility you describe so I
used it.  It told me it was `loading deleted files information' and was
still going strong after an hour.  I went to bed, dreamt of inodes, got
up and there it was still churning away.  Now that partition only has
about 50M of free space so I suspect there is insufficient room to write
the undeleted files to it.  A way to direct the file listing somewhere
else would be useful.
 
> The files in the resulting list don't carry names anymore and the
> shown names are probably mere inode numbers(?) or similar.  Check
> which file(s) might contain the data in question and copy this file
> into a directory located on *another* partition.

Imagine a lot of .deb files.  Imagine having to rename them correctly!
The tedium involved, however, is very much offset by the pleasure of
recovering them.

> And if you've been able to save your data: Rejoice!
 
Eventually I used the recover package from the testing distribution.
You can select deleted files by date and time of deletion and dump them
to a directory on another partition.  It was also quite quick.  Having
read about the difficulty of undeleting files on unix systems I found
the performance of this program impressive.

[Snip good advice on backups]

Brian.

Re: Help!!! undelete for ext3fs!!!

[Mark S. Reglewski]

On Fri, Mar 01, 2002 at 06:28:30PM -0600, Cheryl Homiak wrote:
> [snip]   As
> for backups, I'm really sorry but i can't figure out what a MO disk is.

I think this is tech speak for a magneto-optical disk, which is a rare 
beast that I've never actually seen, only heard about.  You may google 
the web for more info about them.

> Unfortunately, the only facilities I have right now for doing backup of
> any kind is the old floppy, and I probably should have had this data on
> floppy. 

Take it from someone who lived in DOS World for over ten years, floppy
backup is about as good as no backup at all.  Maybe worse, since you 
might have a false sense of security.  Floppies are hideously unreliable,
and just too small to back up present-day large hard disks.

The only thing I use floppies for nowadays is to pass small files to 
friends who don't have Net connections, and for emergency boot disks.
And I always make *three* of those at a crack, since I'm as likely to 
find a corrupted sector on the diskette when I need it as I am to boot
a kernel.  They like to fail at the most inconvenient times.

> I'd love to have a backup system, and you'll get no argument from
> me against its importance, but the reality is that I don't have one right
> now.

CD-Rs work okay for people who don't have large amounts of data to back
up, and they are an inexpensive solution.  

For large amounts of data, tape, preferably SCSI, would seem to be a
common recommendation from the old hands on Linux lists.  Problem is 
that a drive that can back up a large disk won't be cheap.  Add the 
cost of a set of tapes to rotate backups, and the cost of a good SCSI
board if you don't already have a SCSI channel on your machine, and
you're talking a good chunk of change.

I use a poor man's remedy:  I back up to my second hard drive.  This
is a "cold swap" IDE drive.  I have one disk in the bay to which I 
back up, and two extra to rotate.  One is always off-site at my locker
at work, and I tote them back and forth when I go to work to rotate 
the backups.  Since the backups are compressed, and I don't back up
anything I can recreate from my Debian installation CDs, I can get
away with smaller drives for the backup bay than for the primary disk.
The backup disks have either been cannibalized from older systems, or
bought for cheap at used computer shops.  Not an ideal solution, by
any means, but it "works" for some values of "works". At least
I can back up everything that needs backing up on a single medium,
so unattended backups are possible, and the disk-to-disk transfers
are pretty fast.  And it was a lot cheaper than DDS.

Just $0.02 worth.

Cordially,
Mark S. Reglewski

Re: Help!!! undelete for ext3fs!!!

[Cheryl Homiak]

Well, it really is too late now, as this was my root partition and I
couldn't unmount it immediately even if I had known what to do. I had
already looked at Midnight commander but your additions were helpful as I
only saw the information about undeleting from the command line. The
information wasn't life-or-death and I learned a lot in the process. As
for backups, I'm really sorry but i can't figure out what a MO disk is.
Unfortunately, the only facilities I have right now for doing backup of
any kind is the old floppy, and I probably should have had this data on
floppy. I'd love to have a backup system, and you'll get no argument from
me against its importance, but the reality is that I don't have one right
now.
This incident also points out the wisdom in having your linux system
mounted on several partitions so that in cases like this you can unmount
the partition immediately.
As for the trash can, it wouldn't do any good if your hard disk breaks but
could be an asset in momentarily slips of the fingers (or the brain) such
as I had.
If anybody does try this with the ext3fs, I would be very interested in a
post re: the results.
thanks to everybody for their suggestions; I also discovered the
undeletion howto and the recovery program due to a combination of my own
searching and people's comments.
By the way, I learned before i ever started linux that panic is the surest
way to complicate an already bad situation, so that was never an issue.

-- 
Cheryl

Re: Help!!! undelete for ext3fs!!!

[Richard Cobbe]

Lo, on Friday, March 1, Jeff did write:

> Ulf Rompe, 2002-Mar-01 10:25 +0100:
> > 
> > alias rm = 'mv --backup=numbered --target-directory=/tmp/Trashcan'
> > 
> 
> This is nice, and I'm starting to use this from my root and user
> account on my laptop.  
> 
> However, how would I delete from the Trashcan, save removing the 
> alias temporarily?

/bin/rm /tmp/Trashcan/

Specifying the full path blocks alias/function expansion.

Richard

Re: Help!!! undelete for ext3fs!!!

[Bob Hilliard]

Jeff <[EMAIL PROTECTED]> writes:

> 
> Ulf Rompe, 2002-Mar-01 10:25 +0100:
> > 
> > alias rm = 'mv --backup=numbered --target-directory=/tmp/Trashcan'
> > 
> 
> This is nice, and I'm starting to use this from my root and user
> account on my laptop.  
> 
> However, how would I delete from the Trashcan, save removing the 
> alias temporarily?

 ``/bin/rm'' or ``\rm'' will execute th rm binary, not the alias.

Bob
-- 
   _
  |_)  _  |_   Robert D. Hilliard  <[EMAIL PROTECTED]>
  |_) (_) |_)  1294 S.W. Seagull Way   <[EMAIL PROTECTED]>
   Palm City, FL  USA  GPG Key ID: 390D6559 
   PGP Key ID: A8E40EB9

Re: Help!!! undelete for ext3fs!!!

[Karl E. Jorgensen]

On Fri, Mar 01, 2002 at 10:12:51AM -0800, Jeff wrote:
> Ulf Rompe, 2002-Mar-01 10:25 +0100:
> > 
> > alias rm = 'mv --backup=numbered --target-directory=/tmp/Trashcan'
> > 
> 
> This is nice, and I'm starting to use this from my root and user
> account on my laptop.  
> 
> However, how would I delete from the Trashcan, save removing the 
> alias temporarily?

Specify the full path to the rm command, as this prevents alias
substitution:

$ /bin/rm filename

-- 
Karl E. Jørgensen
[EMAIL PROTECTED]
www.karl.jorgensen.com
/"\
\ /  ASCII Ribbon Campaign
 x   - Say NO to HTML in email
/ \  - Say NO to Word documents in email (and Macros!)


pgpvFP1v47Efk.pgp
Description: PGP signature

Re: Help!!! undelete for ext3fs!!!

[Paul Seelig]

On Thu, Feb 28, 2002 at 11:42:36PM -0600, Cheryl Homiak wrote:

> I just deleted something I didn't want to delete; won't hurt my system,
> just destroyed some important records I was keeping.
>
*Immediately* unmount the partition holding this data!  With
"*immediately*" i mean *IMMEDIATELY!*, or better put, RIGHT *NOW*!

An now let's just calm down to be able to think for a minute.

> Is there any way to undelete in ext3fs?
>
Since this is compatible with ext2, ext2 undeletion should be
possible.  Now you have the possibility to find out yourself and tell
us whether this worked or not.

There is a comfortable way for undeletion using the GNU Midnight
Commander, "/usr/bin/mc". If you have it installed, then start it up,
press "F9" and choose "Command | Undelete files (ext2fs only)".  

Enter the device file name without the leading "/dev/" of the
(hopefully unmounted!)  partition containing the deleted files and
wait a few minutes until the panel contains a listing of deleted
files. Depending on size of the partition in question, this can take
up a considerable amount of time. So please be patient even if this
takes half an hour or even far more.

The files in the resulting list don't carry names anymore and the
shown names are probably mere inode numbers(?) or similar.  Check
which file(s) might contain the data in question and copy this file
into a directory located on *another* partition.

And if you've been able to save your data: Rejoice!

> And if there is a way, but you had to have it pre-set up before the
> catastrophe occurred, I'd still like to know about it so I will have a
> safeguard in the future.
>
The only true safeguard is a regular backup.  Other good possibilities
include a regular backup or possibly even a regular backup.  Some
people even go so far to claim that a regular backup is the only
worthwhile protection system because it transcends the limits of you
hard disk and computer live span. Among the multitude of choices just
presented i'd always favour a regular backup. ;-)

I wouldn't bother about a trash can facility because if your hard disk
breaks your trash can will be broken too.  Backups don't get broken
when your hard disk fails *and* when made on secure media like MO
disks (that's what i use and trust).  If the data in question is
*really* important i'd take responsibility to store various
generations of backup media in another room, floor, building or even
city.  Linus himself and most Free Software developers even chose to
spread their data over various continents... ;-)

Good luck, P. *8^)
-- 
If not specific to HP please always reply to 
"Paul Seelig <[EMAIL PROTECTED]>"

Re: Help!!! undelete for ext3fs!!!

[Jeff]

Ulf Rompe, 2002-Mar-01 10:25 +0100:
> 
> alias rm = 'mv --backup=numbered --target-directory=/tmp/Trashcan'
> 

This is nice, and I'm starting to use this from my root and user
account on my laptop.  

However, how would I delete from the Trashcan, save removing the 
alias temporarily?

thanks,
jc

-- 
Jeff CoppockSystems Engineer
Diggin' Debian  Admin and User

Re: Help!!! undelete for ext3fs!!!

[Ulf Rompe]

Sebastiaan <[EMAIL PROTECTED]> writes:

>> Is there any way to undelete in ext3fs?

I'm not shure if this works but I would give the normale "recover" for
ext2 a try. Before using it you should umount the partition. And in
the meantime you should use the partition read-only to get a chance
that the deleted inodes aren't assigned to new files.

> You can setup some kind of Trashcan yourself. Make a directory on your
> system somewhere and make an alias for rm:
> alias rm = 'mv ? /tmp/Trashcan'

alias rm = 'mv --backup=numbered --target-directory=/tmp/Trashcan'

If you want to use a parameter within aliases, you have to use
functions instead:

function rm { mv $* /tmp/Trashcan }

Obviously, all this only works in Bourne Shell derivates like bash.

> If you are on a multiuser system, you definitely have to write a
> script, which moves the deleted files into subdirs in the Trashcan
> which are unreadable by other users.

alias rm = 'mkdir -m 0700 -p /tmp/Trashcan/$USER && \
mv --backup=numbered --target-directory=/tmp/Trashcan/$USER'

[x] ulf

-- 
Der Mensch ist immer noch der beste Computer. (John F. Kennedy)

Re: Help!!! undelete for ext3fs!!!

[Alvin Oga]

hi ya 

dumb question/comment...

since ext3 is just ext2 w/ journalling...
- can you just unplay the journal ??? :-)

otherwise to undelete ext2 files...
and if you did undelete it successfullye...
 i donno what happens to your journaled fs

http://www.Linux-Sec.net/Txt/erase.txt
( look for restore deleted files )


aliasing rm is a sorta whacky way to solve some
of the accidental delete problems.. 

have fun linuxing
alvin

On Fri, 1 Mar 2002, Sebastiaan wrote:

> High,
> 
> On Thu, 28 Feb 2002, Cheryl Homiak wrote:
> 
> > I just deleted something I didn't want to delete; won't hurt my system,
> > just destroyed some important records I was keeping.
> > Is there any way to undelete in ext3fs?
> Ouch, no idea.
> 
> > And if there is a way, but you had to have it pre-set up before the
> > catastrophe occurred, I'd still like to know about it so I will have a
> > safeguard in the future.
> 
> You can setup some kind of Trashcan yourself. Make a directory on your
> system somewhere and make an alias for rm:
> alias rm = 'mv ? /tmp/Trashcan'
> 

Re: Help!!! undelete for ext3fs!!!

[Vector]

I did this, once but it was a pain.  It was under ext2 instead of ext3
but that shouldn't matter in this case.  It also required knowledge of
some of the contents of the file and wasn't very useful for binary
files.  You essentially boot without mounting the filesystem on which
you want to 'undelete' (or you unmount after boot if not the root
partition and after killing all daemons that use the target
filesystem).   Then you grep the device (eg /dev/sdb1) for some part
of the file you want and have it spew so many bytes before and after
what you are looking for so that you can see where the start/stop of
the file is.  Once you have that you use a comand (dd? or something)
to copy those bytes from that location on the device to a file on an
already mounted file system and poof, you have it back.

I know this is rather vague but you get the idea of the approach.  I
wish I could give you more detail but I did this around 4 years ago
and haven't really needed to do much like it since.

vec

- Original Message -
From: "Sebastiaan" <[EMAIL PROTECTED]>
To: "Cheryl Homiak" <[EMAIL PROTECTED]>
Cc: 
Sent: Friday, March 01, 2002 12:19 AM
Subject: Re: Help!!! undelete for ext3fs!!!


> High,
>
> On Thu, 28 Feb 2002, Cheryl Homiak wrote:
>
> > I just deleted something I didn't want to delete; won't hurt my
system,
> > just destroyed some important records I was keeping.
> > Is there any way to undelete in ext3fs?
> Ouch, no idea.
>
> > And if there is a way, but you had to have it pre-set up before
the
> > catastrophe occurred, I'd still like to know about it so I will
have a
> > safeguard in the future.
>
> You can setup some kind of Trashcan yourself. Make a directory on
your
> system somewhere and make an alias for rm:
> alias rm = 'mv ? /tmp/Trashcan'
>
> not sure about the ? which should be the filename. Or write a script
for
> this. If you are on a multiuser system, you definitely have to write
a
> script, which moves the deleted files into subdirs in the Trashcan
which
> are unreadable by other users.
>
> Greetz,
> Sebastiaan
>
>
>
> --
> To UNSUBSCRIBE, email to [EMAIL PROTECTED]
> with a subject of "unsubscribe". Trouble? Contact
[EMAIL PROTECTED]
>

Re: Help!!! undelete for ext3fs!!!

[Sebastiaan]

High,

On Thu, 28 Feb 2002, Cheryl Homiak wrote:

> I just deleted something I didn't want to delete; won't hurt my system,
> just destroyed some important records I was keeping.
> Is there any way to undelete in ext3fs?
Ouch, no idea.

> And if there is a way, but you had to have it pre-set up before the
> catastrophe occurred, I'd still like to know about it so I will have a
> safeguard in the future.

You can setup some kind of Trashcan yourself. Make a directory on your
system somewhere and make an alias for rm:
alias rm = 'mv ? /tmp/Trashcan'

not sure about the ? which should be the filename. Or write a script for
this. If you are on a multiuser system, you definitely have to write a
script, which moves the deleted files into subdirs in the Trashcan which
are unreadable by other users.

Greetz,
Sebastiaan

Help!!! undelete for ext3fs!!!

[Cheryl Homiak]

I just deleted something I didn't want to delete; won't hurt my system,
just destroyed some important records I was keeping.
Is there any way to undelete in ext3fs?
And if there is a way, but you had to have it pre-set up before the
catastrophe occurred, I'd still like to know about it so I will have a
safeguard in the future.
I can only find references to undeletion for ext2fs.
TIA.

-- 
Cheryl

Re: undelete for ext2

[Shriram Shrikumar]

> I was once asked whether or not GNU/Linux had any features to
> prevent
> users from doing bone-headed stupid things.
> 
> Yes, I said.
> 
> Bitter experience.

Sometimes, even that isn't enough - especially when you are me. I
have been through all the requirements to properly back up data and
such which is followed to the letter on my machine @ work cos it does
have vital data. For my home computer however, the amount of work
required to do all these things seems to be far too much work to do
to merely minimize risk - and I tend to get at with it MOST of the
time. And if it wasn't for plain utter stupidity, it probably
would've have been fine as well.

There wasn't really any vital data on the HD anyway and i suppose a
full re-install would be easier than going through all the backup
procedures.

This also gives me an opportunity to repartition better to start off
with. Thanx for your help and also for the link to the partitioning
mini-FAQ - I've been looking for something like that for ages.


Regards,



Shri

__
Do You Yahoo!?
Make international calls for as low as $.04/minute with Yahoo! Messenger
http://phonecard.yahoo.com/

Re: undelete for ext2

[Florian Weimer]

Shriram Shrikumar <[EMAIL PROTECTED]> writes:

> it seems to find the deleted inodes and then tries to dump them in a
> specified folder which leaves me with a lot of dump files -
> anybody with any clues as to what I can do with these files to put
> them back where they belong ? or maybe even a better undelete
> sofware.

Hmm, restore your backup. ;-)

The file names were stored in the directory entries, which likely have
been overwritten during the deletion process.

So the best thing is to recover the essential data (e.g., mailboxes),
and just reinstall the system (after a backup).

-- 
Florian Weimer[EMAIL PROTECTED]
University of Stuttgart   http://cert.uni-stuttgart.de/
RUS-CERT  +49-711-685-5973/fax +49-711-685-5898

undelete for ext2

[Shriram Shrikumar]

Hi All,

It was pleasant afternoon when I realised that maybe, today would be
a good day to move the /var partition just to / so I can use the
extra space elsewhere and / had a couple of hundred megs not being
used. I went into singe user mode and then,

cd /
mkdir var2

cd /var
mv * /var2

after churning around for a while, it gave up and told me that there
was no space. I gave up on moving var the var parition and before
thinking gave

cd /
rm var2 -r

Thus started my adventure into ext2 undeletion software.

I have already tried recover which i pulled off of freshmeat.net

http://freshmeat.net/projects/recover/

it seems to find the deleted inodes and then tries to dump them in a
specified folder which leaves me with a lot of dump files -
anybody with any clues as to what I can do with these files to put
them back where they belong ? or maybe even a better undelete
sofware.

Any help appreciated.

Thanx


Shri
PS - running sid with 2.4.7


__
Do You Yahoo!?
Make international calls for as low as $.04/minute with Yahoo! Messenger
http://phonecard.yahoo.com/

Re: undelete for ext2

[Karsten M. Self]

on Sun, Aug 05, 2001 at 08:16:08AM -0700, Shriram Shrikumar ([EMAIL PROTECTED]) 
wrote:
> Hi All,
> 
> It was pleasant afternoon when I realised that maybe, today would be
> a good day to move the /var partition just to / so I can use the
> extra space elsewhere and / had a couple of hundred megs not being
> used. I went into singe user mode and then,
> 
> cd /
> mkdir var2
> 
> cd /var
> mv * /var2
> 
> after churning around for a while, it gave up and told me that there
> was no space. I gave up on moving var the var parition and before
> thinking gave
> 
> cd /
> rm var2 -r
> 
> Thus started my adventure into ext2 undeletion software.

<...>

> Any help appreciated.

I was once asked whether or not GNU/Linux had any features to prevent
users from doing bone-headed stupid things.

Yes, I said.

Bitter experience.



You've just learned something.  Your data is, in all likelihood, gone.
You might get parts of it back, but a complete restore is very unlikely,
and will be quite time consuming.

  - Buy yourself a backup system.  I recommend DAT tape, CDR, or
alternate networked storage.
  - Use it.
  - Take appropriate measures before you do any serious mucking with
your partitions in the future.

E.g.:  don't 'mv' data, copy it.  This leaves you with two images of the
data, in the event one goes bad.

Your going to single-user mode was the one smart thing you'd done --
this minimizes any changes to data while you're working.  Better yet,
boot a rescue system and mount the partitions you're doing surgery on
someplace outside the normal filesystem heirarchy.

My MO for any filesystem surgery is:

- Go single-user or boot a rescue system.

Do *both* the following:

- Create tape backups of data to be moved.
- Create filesystem backups (either locally, if space permits, or networked
   to another station).

This provides redundant backups, and gives me one fast method for
restoring data (the filesystem backups).

- VERIFY YOUR BACKUPS.  Missing, incomplete, or inaccurate backups
  won't do much for you.

- *COPY* data from old to new locations.  Various means work, I
  prefer the older:

  $ tar cvf - /* | ( cd ; tar xvf - )

- *VERIFY* the move:

  $ diff --recursive --brief  

- Rename the old tree, and move the new tree to its location.
  Change mount points if appropriate.

- Resume multi-user operation or reboot system.  Sniff around.  If
  there are any problems, you've still got:

  - A tape archive.
  - A disk archive.
  - The old disk tree.

- After a suitable test period (minutes, hours, days, your option),
  go ahead and recycle your old bytes by nuking the old directory.

Yes, as a general consequence, repartitioning is a somewhat
time-consuming operation.  This is one of the reasons I try to shoot for
a good, long-lived partitioning schema on my boxen. 

For general backup suggestions:

http://kmself.home.netcom.com/Linux/FAQs/backups.html

Partitioning suggestions:

http://kmself.home.netcom.com/Linux/FAQs/partition.html

Cheers.

-- 
Karsten M. Self http://kmself.home.netcom.com/
 What part of "Gestalt" don't you understand?   There is no K5 cabal
  http://gestalt-system.sourceforge.net/ http://www.kuro5hin.org
   Free Dmitry!! Boycott Adobe!! Repeal the DMCA!!   http://www.freesklyarov.org
Geek for Hire  http://kmself.home.netcom.com/resume.html


pgpILnXEPdpNJ.pgp
Description: PGP signature

Re: Midnight commander undelete?

[Adam C Powell IV]

Martin Bialasinski wrote:

> * Adam C Powell, IV  wrote:
>
> > Oops, typo in the email!  I was trying /#undel:hdb1 but to no avail.
> > Just tried it again, no such file or directory.
>
> mc -V says the undelfs is not compiled in. I have no idea why, the
> object file is compiled during build. Maybe because it is build in a
> chroot. I'll have to investigate further.

Thank you very much!  recover worked fine, but it would be nice to have this
mc feature working.

I just filed bug #88862, so people can see it's a known problem.

-Adam P.

GPG fingerprint: D54D 1AEE B11C CE9B A02B  C5DD 526F 01E8 564E E4B6

 Welcome to the best software in the world today cafe!

Re: Midnight commander undelete?

[Martin Bialasinski]

* Adam C Powell, IV  wrote:

> Oops, typo in the email!  I was trying /#undel:hdb1 but to no avail.
> Just tried it again, no such file or directory.

mc -V says the undelfs is not compiled in. I have no idea why, the
object file is compiled during build. Maybe because it is build in a
chroot. I'll have to investigate further.

Ciao,
Martin

Re: Midnight commander undelete?

[Adam C Powell IV]

Martin Bialasinski wrote:

> * Adam C Powell, IV  wrote:
>
> Hi,
>
> > So I looked through /var/lib/dpkg/available and found something
> > promising-looking in mc.  I installed, ran, read the instructions,
> > and tried to cd /#debug:hdb1 but it kept saying no such file or
> > directory.
>
> It's cd /#undel:hdb1
>
> Why do you think it is #debug?

Oops, typo in the email!  I was trying /#undel:hdb1 but to no avail.  Just
tried it again, no such file or directory.

Thanks,

-Adam P.

GPG fingerprint: D54D 1AEE B11C CE9B A02B  C5DD 526F 01E8 564E E4B6

 Welcome to the best software in the world today cafe!

Re: Midnight commander undelete?

[Martin Bialasinski]

* Adam C Powell, IV  wrote:

Hi,

> So I looked through /var/lib/dpkg/available and found something
> promising-looking in mc.  I installed, ran, read the instructions,
> and tried to cd /#debug:hdb1 but it kept saying no such file or
> directory.

It's cd /#undel:hdb1

Why do you think it is #debug?

Ciao,
Martin

Re: Midnight commander undelete?

[Adam C Powell IV]

mike polniak wrote:

> Adam C Powell IV wrote:
> >
> > Can anyone help me to properly use mc or any other undelete function?
>
> Try> apt-get install recover
> Then go to www.linux-mag.com and read about recover and undeleting files
> in the August 2000 issue.

Oh, excellent, cool, amazing!  That's a really terrific utility!  It totally
automates the awful process from the ext2 recovery readme!

I'm running potato, but "fakeroot apt-get -b source recover" (Build-Depends only
on debhelper) built a working package that got the file I needed.

I'll know in a little while whether it's completely intact...

Thank you so much!!

-Adam P.

GPG fingerprint: D54D 1AEE B11C CE9B A02B  C5DD 526F 01E8 564E E4B6

   Welcome to the best software in the world today cafe!

Re: Midnight commander undelete?

[mike polniak]

> 
> Can anyone help me to properly use mc or any other undelete function?

Try> apt-get install recover
Then go to www.linux-mag.com and read about recover and undeleting files
in the August 2000 issue.
-- 
LINUX~~nobody owns it~~everybody can use it~~anybody can improve it
~~~

Midnight commander undelete?

[Adam C Powell IV]

Greetings,

[Please cc me in replies...  Thank you.]

I erased a file this morning on an ext2fs partition on a potato machine, and
would like to recover it.  So I looked through /var/lib/dpkg/available and
found something promising-looking in mc.  I installed, ran, read the
instructions, and tried to cd /#debug:hdb1 but it kept saying no such file or
directory.  This despite the potato mc package description saying, "This
version comes with undelete for ext2 filesystems compiled in."

The mc "homepage" on gnome.org is totally useless, and everything else (e.g.
the GNU page) points to it.  The GNOME Documentation Project is totally
useless for mc as well, and their maillist archives search function is broken
for mc.

So I searched the debian-user archives, and found a reference to
/usr/share/doc/HOWTO/en-txt/mini/Ext2fs-Undeletion.txt.gz but  that howto is
well over a year old and requires a program called "fsgrab" which isn't listed
in potato/Contents-i386.gz.  Oh well.  At least now I think I have a couple of
good inode candidates...

Can anyone help me to properly use mc or any other undelete function?

Thank you very much,

-Adam P.

GPG fingerprint: D54D 1AEE B11C CE9B A02B  C5DD 526F 01E8 564E E4B6

 Welcome to the best software in the world today cafe!

Re: undelete? Help

[Bill Jonas]

On Sat, Dec 23, 2000 at 01:40:24PM +, Colin Watson wrote:
> See the Ext2fs-Undeletion mini-HOWTO
> (/usr/share/doc/HOWTO/en-txt/mini/Ext2fs-Undeletion.txt.gz, for
> instance). Also try the recover and/or gtkrecover packages if you're
> running unstable.

I gave a talk about ext2 file undeletion to my LUG
(http://www.phillylinux.org/) a couple of months ago.  If you'd like,
my notes from the talk are available at
http://www.billjonas.com/papers/undeletion.html; this page contains
basically the exact steps I took when I did the same thing several months
ago.

-- 
Bill Jonas| "In contrast to the What You See Is What You
[EMAIL PROTECTED]|  Get (WYSIWYG) philosophy, UNIX is the You
http://www.billjonas.com/ |  Asked For It, You Got It operating system."
http://www.debian.org/|  --Scott Lee, as quoted by Lamb and Robbins

Re: undelete? Help

[Sebastiaan]

Thanks,

now it is 'only' puzzeling (it seems that I had the kernel source stored
in my homedir).

Thanks,
Sebastiaan


On Sat, 23 Dec 2000, Colin Watson wrote:

> Sebastiaan <[EMAIL PROTECTED]> wrote:
> >Yes I know, it is stupid, but I just deleted everything in my
> >homedir. Glad I made a backup of important files today.
> >
> >Is there a way to retreive deleted files? In the Amiga days there were
> >lots of programs to undelete files. Is there also a program for Linux?
> 
> See the Ext2fs-Undeletion mini-HOWTO
> (/usr/share/doc/HOWTO/en-txt/mini/Ext2fs-Undeletion.txt.gz, for
> instance). Also try the recover and/or gtkrecover packages if you're
> running unstable.
> 
> -- 
> Colin Watson [EMAIL PROTECTED]
> 
> 
> -- 
> To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
> with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
> 
> 

Re: undelete? Help

[Colin Watson]

Sebastiaan <[EMAIL PROTECTED]> wrote:
>Yes I know, it is stupid, but I just deleted everything in my
>homedir. Glad I made a backup of important files today.
>
>Is there a way to retreive deleted files? In the Amiga days there were
>lots of programs to undelete files. Is there also a program for Linux?

See the Ext2fs-Undeletion mini-HOWTO
(/usr/share/doc/HOWTO/en-txt/mini/Ext2fs-Undeletion.txt.gz, for
instance). Also try the recover and/or gtkrecover packages if you're
running unstable.

-- 
Colin Watson [EMAIL PROTECTED]

undelete? Help

[Sebastiaan]

Hi,

Yes I know, it is stupid, but I just deleted everything in my
homedir. Glad I made a backup of important files today.

Is there a way to retreive deleted files? In the Amiga days there were
lots of programs to undelete files. Is there also a program for Linux?

THanks in advance,
Sebastiaan

Re: rm -R /usr/ - undelete....

[Alvin Oga]

hi ya...

"interactive" mode for rm -i  foo is fine...as long
as you don't remove too many files ???

think the trick is if "rm -rf /usr" is a directory.
rm should query you.

if you do "rm /usr/blah"...than just go ahead and don't
botheras if "-f" was specified ???

if you do "rm -rf /any_dir" as rootalias it ???

... a simple aliase "rm -i"  drives me nuts...
and too lazy to type rm -f  too

and better still if you can find a usable/workable
"undelete" programeven better...
- long ago found something that works only for
small files/dirs

-----

oh welll...too many possibilities.just have a good
backup/recovery/undelete system in place...that will get you up
and running within the hour...

c ya
alvin


On Sat, 10 Jun 2000, S. Salman Ahmed wrote:

> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA1
> 
> >>>>> "JIS" == Jacob I Stowell <[EMAIL PROTECTED]> writes:
> JIS>  hello i am a new debian user and i just learned a hard lesson.
> JIS> I guess it is a bad idea to issue the following command:
> JIS> 
> JIS> rm -R /usr/
> JIS> 
> JIS> i try to look at the bright side, you know make lemonade and
> JIS> all that, so at least i get a new system as a result of my
> JIS> bonehead mistake.  Hopefully i will make different, and yet
> JIS> equally idiotic mistakes in the future.
> JIS> 
> JIS> thanks for listening, i just needed to vent.
> JIS> 
> 
> One way to reduce the likelihood of sth like that from happening again
> is to alias rm to "rm -i" which puts rm in interactive mode. That way rm
> will prompt you for everything but at least it will remind you whether
> or not you really should go ahead.
> 
> Its not foolproof, however, since you could still type "rm -f" or "rm
> - -fr" which will override the interactive mode ...
> 
> Be esp. careful when logged in as root.
> 
> - -- 
> Salman Ahmed
> ssahmed AT pathcom DOT com
> 
> http://www.pathcom.com/~ssahmed
> GnuPG Key fingerprint = A6DB 6C85 DE5A 33BB E873  E437 58B2 09CD 977B 900B
> 
> -BEGIN PGP SIGNATURE-
> Version: GnuPG v1.0.1 (GNU/Linux)
> Comment: Processed by Mailcrypt 3.5.5 and Gnu Privacy Guard 
> <http://www.gnupg.org/>
> 
> iD8DBQE5QuQRWLIJzZd7kAsRAqIQAKDCk6ep7HVLsbpR2Za97TJgd/4suwCeOzI6
> QIcQnoYVQrQHTW3Q8/D8Nw8=
> =qM9X
> -END PGP SIGNATURE-
> 
> 
> -- 
> Unsubscribe?  mail -s unsubscribe [EMAIL PROTECTED] < /dev/null
> 

Re: undelete for partition tables?

[Jaldhar H. Vyas]

On Sun, 12 Sep 1999, Laurent PICOULEAU wrote:

> Lo?c Prylli posted a C programm on the newsgroup fr.comp.os.linux some 2
> years ago to detect an ext2 partition that can help to solve Jaldhar's 
> problem.
> This programm can be found on  but I don't know
> the exact URL. If you can't find it, I have a copy of it
> 

I was unable to find this program.  Doing a web search, I did find one
called gpart but I would like to look at the program you mention too.
Then I will package whichever one is better for Debian.

So please send me the location or a copy if you can.  

-- 
Jaldhar H. Vyas <[EMAIL PROTECTED]>

Re: undelete for partition tables?

[Jaldhar H. Vyas]

On Sun, 12 Sep 1999, Tom Pfeifer wrote:

> Instead of me trying to cover every possible detail now (which is
> impossible anyway), I suggest you try following my procedure and try to
> account for the differences in your situation as you do it. If you have
> specific questions or problems, feel free to ask. If you really want to
> do this, you are going to have to get into this up to your eyeballs
> anyway  - I can only try to get you started.
> 

Owing to work, we were unable to work on this until Friday evening but I'm
happy to report at least partial success.  My colleague bought Norton
System Works 2000, the latest version.  The version of DiskEdit in there
does support >8GB drives.  It also has a menu command for linking in a
partition that safely adds it into the partition table for you.  Any way
the root partition was toasted.  But apart from the files in /etc it
didn't have anything much that  couldn't be replaced.  The all-important
/home partition came through fine. /var seemed to be fine when mounted
read-only but when I tried to mount it read-write, the kernel complained
that the ext2 file system had unsupported options.  In the end what I did
was to tar it up, erase and remake the filesystem and recopy the files
again.  Now the only remaining problem is the /usr partition.  On trying
to mount it I get:

mount: wrong fs type, bad option, bad superblock on /dev/hda6,
   or too many mounted file systems

e2fsck has a -b option that will restore the superblock from backups that
are kept throughout the file system but you have to give it the number of
a sector which contains one.  Do you know what the signature of a
superblock should be?

If worst comes to worst we will just blow it away and reinstall.  There is
nothing in /usr that can't be replaced.

-- 
Jaldhar H. Vyas <[EMAIL PROTECTED]>

Re: FDISK parameters was Re: undelete for partition tables?

[Tom Pfeifer]

Ed Cogburn wrote:
> 
> OK, I'm wrong about -u, it does work; I should have looked
> closer.  The use of 'fdisk -l', without a device parameter, still
> doesn't work even though the man page says it should.
> According to Tom's examples and the man page, "fdisk -l" and
> "fdisk -l -u" should work without a device parameter, but I get:
> 
> **
> 08:00pm /home/ed\> fdisk -v
> fdisk v2.9w
> 08:00pm /home/ed\> fdisk -l
> 
> Usage: fdisk [-l] [-b SSZ] [-u] device
> E.g.: fdisk /dev/hda  (for the first IDE disk)
>   or: fdisk /dev/sdc  (for the third SCSI disk)
>   or: fdisk /dev/eda  (for the first PS/2 ESDI drive)

Ed,

Just for reference, on slink (fdisk v2.9g) I get the output shown below,
and I've never seen fdisk NOT work this way. It also works this way on
my potato installation, but the version I have there is 2.9r I believe.
At any rate, it's not v2.9w version like you have - I have not updated
potato is quite a while.

[EMAIL PROTECTED]:~# fdisk -l

Disk /dev/hda: 255 heads, 63 sectors, 784 cylinders
Units = cylinders of 16065 * 512 bytes

   Device Boot   Start  End   Blocks   Id  System
/dev/hda11   65   522081b  Win95 FAT32
/dev/hda2   66  130   522112+   6  DOS 16-bit >=32M
/dev/hda3  131  212   658665b  Win95 FAT32
/dev/hda4  213  783  4586557+   5  Extended
/dev/hda5  213  414  1622533+  83  Linux native
/dev/hda6  415  544  1044193+   6  DOS 16-bit >=32M
/dev/hda7  545  560   128488+   6  DOS 16-bit >=32M
/dev/hda8  561  783  17912166  DOS 16-bit >=32M

Disk /dev/hdb: 255 heads, 63 sectors, 784 cylinders
Units = cylinders of 16065 * 512 bytes

   Device Boot   Start  End   Blocks   Id  System
/dev/hdb11   65   522081   83  Linux native
/dev/hdb2   66  147   658665b  Win95 FAT32
/dev/hdb3  148  195   3855606  DOS 16-bit >=32M
/dev/hdb4  196  783  47231105  Extended
/dev/hdb5  196  212   136521   82  Linux swap
/dev/hdb6  213  289   618471   83  Linux native
/dev/hdb7  290  366   618471   83  Linux native
/dev/hdb8  367  398   257008+  83  Linux native
/dev/hdb9  399  523  10040316  DOS 16-bit >=32M
/dev/hdb10 524  783  2088418+   6  DOS 16-bit >=32M

Disk /dev/hdc: 255 heads, 63 sectors, 1653 cylinders
Units = cylinders of 16065 * 512 bytes

   Device Boot   Start  End   Blocks   Id  System
/dev/hdc11  255  2048256   83  Linux native
/dev/hdc2   *  256  447  1542240   83  Linux native
/dev/hdc3  448  532   682762+  83  Linux native
/dev/hdc4  533 1651  8988367+   f  Win95 Extended (LBA)
/dev/hdc5  533  549   136521   82  Linux swap
/dev/hdc6  550  651   819283+  83  Linux native
/dev/hdc7  652  779  1028128+  83  Linux native
/dev/hdc8  780  78656196   83  Linux native
/dev/hdc9  787  850   514048+   7  OS/2 HPFS
/dev/hdc10 851  914   514048+   6  DOS 16-bit >=32M
/dev/hdc11 915 1001   698796b  Win95 FAT32
/dev/hdc121002 1078   6184716  DOS 16-bit >=32M
/dev/hdc131079 1270  1542208+  83  Linux native
/dev/hdc141271 1398  1028128+   6  DOS 16-bit >=32M

Re: FDISK parameters was Re: undelete for partition tables?

[Ed Cogburn]

Mirek Kwasniak wrote:
> 
> On Tue, Sep 14, 1999 at 12:54:47PM +, Ed Cogburn wrote:
> >
> >   I just tried (as root) the three fdisk examples (-l is lowercase
> > L) given above.  Only the last one worked: "fdisk -l /dev/hda".
> > The -u does nothing at all.  Does anybody else see this behavior,
> > or has my fdisk been lobotomized somehow?
> 
> Hi,
> $ fdisk -v
> fdisk v2.9w
> 
> $fdisk -l  /dev/hda
> 
> Disk /dev/hda: 255 heads, 63 sectors, 1027 cylinders
> Units = cylinders of 16065 * 512 bytes
> 
>Device BootStart   EndBlocks   Id  System
> /dev/hda1   646  1027   3068415   83  Linux
> /dev/hda2   *   608   645305235   83  Linux
> /dev/hda3 1   607   4875696   83  Linux
> $ fdisk -l -u /dev/hda
> 
> Disk /dev/hda: 255 heads, 63 sectors, 1027 cylinders
> Units = sectors of 1 * 512 bytes
> 
>Device BootStart   EndBlocks   Id  System
> /dev/hda1  10361925  16498754   3068415   83  Linux
> /dev/hda2   *   9751455  10361924305235   83  Linux
> /dev/hda363   9751454   4875696   83  Linux
> 
> Do you see a difference? To see all disks you can use
> 
>fdisk -l -u /dev/hd? /dev/sd?
> 
> or try another program
> 
>   sfdisk -l -uS
> 
> Mirek


OK, I'm wrong about -u, it does work; I should have looked
closer.  The use of 'fdisk -l', without a device parameter, still
doesn't work even though the man page says it should.
According to Tom's examples and the man page, "fdisk -l" and
"fdisk -l -u" should work without a device parameter, but I get:

**
08:00pm /home/ed\> fdisk -v
fdisk v2.9w
08:00pm /home/ed\> fdisk -l

Usage: fdisk [-l] [-b SSZ] [-u] device
E.g.: fdisk /dev/hda  (for the first IDE disk)
  or: fdisk /dev/sdc  (for the third SCSI disk)
  or: fdisk /dev/eda  (for the first PS/2 ESDI drive)
  or: fdisk /dev/rd/c0d0  or: fdisk /dev/ida/c0d0  (for RAID
devices)
  ...
**

Oh, well.

-- 
Ed C.

Re: FDISK parameters was Re: undelete for partition tables?

[Wayne Topa]

Subject: Re: FDISK parameters was Re: undelete for partition tables?
Date: Tue, Sep 14, 1999 at 12:54:47PM +

In reply to:Ed Cogburn

Quoting Ed Cogburn([EMAIL PROTECTED]):
> Tom Pfeifer wrote:
> > 
> > Ed Cogburn wrote:
> > 
> 
> 
>   I just tried (as root) the three fdisk examples (-l is lowercase
> L) given above.  Only the last one worked: "fdisk -l /dev/hda". 
> The -u does nothing at all.  Does anybody else see this behavior,
> or has my fdisk been lobotomized somehow?
> 

Ed

VT2 root-Deb-Slink:~/mysql# fdisk -v
fdisk v2.9g


VT2 root-Deb-Slink:~/mysql# fdisk -l /dev/hda

Disk /dev/hda: 255 heads, 63 sectors, 1027 cylinders
Units = cylinders of 16065 * 512 bytes

   Device Boot   Start  End   Blocks   Id  System
/dev/hda11   31   248976b  Win95 FAT32
/dev/hda2   32   63   2570406  DOS 16-bit >=32M
/dev/hda3   64   95   257040   83  Linux native
/dev/hda4   96 1027  74862905  Extended
/dev/hda5   96  248  1228941   83  Linux native
/dev/hda6  249  281   265041   83  Linux native
/dev/hda7  282  320   313236   83  Linux native
/dev/hda8  321  335   120456   82  Linux swap
/dev/hda9  336  476  1132551   83  Linux native
/dev/hda10 477  623  1180746   83  Linux native
/dev/hda11 624  750  1020096   83  Linux native
/dev/hda12 751 1027  2224971   83  Linux native

VT2 root-Deb-Slink:~/mysql# fdisk -u /dev/hda

The number of cylinders for this disk is set to 1027.
There is nothing wrong with that, but this is larger than 1024,
and could in certain setups cause problems with:
1) software that runs at boot time (e.g., LILO)
2) booting and partitioning software from other OSs
   (e.g., DOS FDISK, OS/2 FDISK)

Command (m for help):

HTH

Wayne 
-- 
Error reading FAT record: Try the SKINNY one? (Y/N)
___

Re: FDISK parameters was Re: undelete for partition tables?

[Mirek Kwasniak]

On Tue, Sep 14, 1999 at 12:54:47PM +, Ed Cogburn wrote:
> 
>   I just tried (as root) the three fdisk examples (-l is lowercase
> L) given above.  Only the last one worked: "fdisk -l /dev/hda". 
> The -u does nothing at all.  Does anybody else see this behavior,
> or has my fdisk been lobotomized somehow?

Hi,
$ fdisk -v
fdisk v2.9w

$fdisk -l  /dev/hda

Disk /dev/hda: 255 heads, 63 sectors, 1027 cylinders
Units = cylinders of 16065 * 512 bytes

   Device BootStart   EndBlocks   Id  System
/dev/hda1   646  1027   3068415   83  Linux
/dev/hda2   *   608   645305235   83  Linux
/dev/hda3 1   607   4875696   83  Linux
$ fdisk -l -u /dev/hda

Disk /dev/hda: 255 heads, 63 sectors, 1027 cylinders
Units = sectors of 1 * 512 bytes

   Device BootStart   EndBlocks   Id  System
/dev/hda1  10361925  16498754   3068415   83  Linux
/dev/hda2   *   9751455  10361924305235   83  Linux
/dev/hda363   9751454   4875696   83  Linux

Do you see a difference? To see all disks you can use 

   fdisk -l -u /dev/hd? /dev/sd? 

or try another program

  sfdisk -l -uS

Mirek

Re: FDISK parameters was Re: undelete for partition tables?

[Ed Cogburn]

Tom Pfeifer wrote:
> 
> Ed Cogburn wrote:
> 
> > > In the future, I would recommend saving the output of either...
> > >
> > > 1) Linux fdisk ==>> fdisk -l > part.txt(this does all drives)
> > > 2) Ranish PM   ==>> part -d 1 -p -r > part.txt  (for each drive)
> >
> > Tom, or somebody, what version of fdisk do you have?  My copy
> > (v2.9w on a full potato system) doesn't support the -l and -u
> > options as they are described in the man page on my sys (and given
> > by Tom's example above).  The -l option still requires the user to
> > give an explicit device to operate on, and AFAICT the -u option
> > doesn't work at all with the fdisk I have.
> >
> > P.S., Ranish PM is only DOS right (ie, no Linux version)?
> > --
> 
> I'm running slink right now which has fdisk v2.9g. I also have potato
> installed elsewhere, and 'fdisk -l' also works there as far as I know.
> By the way, that is a small L, not a one.
> 
> 'fdisk -l' lists all partitions on all drives using cylinder values
> 'fdisk -l -u' lists all partitions on all drives using sector values
> 'fdisk -l /dev/hda' would list all partitions, but just on /dev/hda
> 
> Ranish Partition Manager is a DOS program, but is an excellent
> partitioning tool. It's source code is available for download from the
> web site. At one the time the author was planning on porting it over to
> Linuxhasn't gotten to it yet.
> 
> Tom


I just tried (as root) the three fdisk examples (-l is lowercase
L) given above.  Only the last one worked: "fdisk -l /dev/hda". 
The -u does nothing at all.  Does anybody else see this behavior,
or has my fdisk been lobotomized somehow?


-- 
Ed C.

Re: FDISK parameters was Re: undelete for partition tables?

[Tom Pfeifer]

Ramakrishnan M wrote:
> 
> On Tue, 14 Sep 1999, Tom Pfeifer wrote:
> 
> > Ranish Partition Manager is a DOS program, but is an excellent
> > partitioning tool. It's source code is available for download from the
> > web site. At one the time the author was planning on porting it over to
> 
> Which site?

Sorry about that. Ranish PM and it's source code can be found here:

http://www.users.intercom.com/~ranish/part/ 

Tom

Re: FDISK parameters was Re: undelete for partition tables?

[Ramakrishnan M]

On Tue, 14 Sep 1999, Tom Pfeifer wrote:

> Ranish Partition Manager is a DOS program, but is an excellent
> partitioning tool. It's source code is available for download from the
> web site. At one the time the author was planning on porting it over to

Which site?


Ramakrishnan M
World Wide Web: http://www.ee.iitm.ernet.in/~ee98m09
--
"A designer knows he has achieved perfection not when there is nothing
 left to add, but when there is nothing left to take away."

Re: FDISK parameters was Re: undelete for partition tables?

[Tom Pfeifer]

Ed Cogburn wrote:

> > In the future, I would recommend saving the output of either...
> >
> > 1) Linux fdisk ==>> fdisk -l > part.txt(this does all drives)
> > 2) Ranish PM   ==>> part -d 1 -p -r > part.txt  (for each drive)
> 
> Tom, or somebody, what version of fdisk do you have?  My copy
> (v2.9w on a full potato system) doesn't support the -l and -u
> options as they are described in the man page on my sys (and given
> by Tom's example above).  The -l option still requires the user to
> give an explicit device to operate on, and AFAICT the -u option
> doesn't work at all with the fdisk I have.
> 
> P.S., Ranish PM is only DOS right (ie, no Linux version)?
> --

I'm running slink right now which has fdisk v2.9g. I also have potato
installed elsewhere, and 'fdisk -l' also works there as far as I know.
By the way, that is a small L, not a one.

'fdisk -l' lists all partitions on all drives using cylinder values
'fdisk -l -u' lists all partitions on all drives using sector values
'fdisk -l /dev/hda' would list all partitions, but just on /dev/hda

Ranish Partition Manager is a DOS program, but is an excellent
partitioning tool. It's source code is available for download from the
web site. At one the time the author was planning on porting it over to
Linuxhasn't gotten to it yet.

Tom

FDISK parameters was Re: undelete for partition tables?

[Ed Cogburn]

Tom Pfeifer wrote:
> 
> > > Question: Was that possibly a Linux extended partition (type 85) as
> > > opposed to a DOS extnded partition? That would explain why DOS fdisk
> > > could delete it.
> >
> > Yes, originally this computer was set up by me with linux only.  It was my
> > colleague who starte messing with DOS fdisk.  (Strictly speaking win98
> > fdisk)
> 
> OK, but if it was a Linux type 85 extended partition, you would not be
> able to access any Windows partitions inside of it *from* Win98. It
> wouldn't recognize it as an extended partition. Also Win98 can't boot
> from an extended/logical drive. It had to be installed on a primary that
> has been deleted.
> 
> In the future, I would recommend saving the output of either...
> 
> 1) Linux fdisk ==>> fdisk -l > part.txt(this does all drives)
> 2) Ranish PM   ==>> part -d 1 -p -r > part.txt  (for each drive)


Tom, or somebody, what version of fdisk do you have?  My copy
(v2.9w on a full potato system) doesn't support the -l and -u
options as they are described in the man page on my sys (and given
by Tom's example above).  The -l option still requires the user to
give an explicit device to operate on, and AFAICT the -u option
doesn't work at all with the fdisk I have.

P.S., Ranish PM is only DOS right (ie, no Linux version)?
-- 
Ed "one in need of a clue" C.

Re: undelete for partition tables?

[Laurent PICOULEAU]

On Sat, 11 Sep, 1999 à 08:49:24PM -0400, Tom Pfeifer wrote:
> "Jaldhar H. Vyas" wrote:
> > 
> > Partition records exactly as they appear in MBR (EMBR):
> > 
> In fact, I don't even know how he deleted that partition with DOS fdisk
> since it normally is not capable of deleting an extended partition that
> still contains non-DOS logical drives - which it also can't delete. 
> 
I think that win98's fdisk is able of such abomination when you ask the
support of large disk.

> I have used Norton's Disk Editor in the past to search for a sector when
> I have some knowledge of what's in that sector. For example, all
> partition sectors end with the signature "55 AA" as the last two bytes.
> However, even the newest version of the Disk Editor (from NU4) is not
> able to search a disk past 1023 cylinders (8 GB), and your disk is 17 GB
> 
> The best I can suggest right now is if you have a copy of Norton's Disk
> Editor around, post back and I can give you a rundown on how to search
> for that sector - understanding that it may not work because of the size
> of the disk.
> 
> Failing that, maybe someone reading this list knows a way to attack this
> problem using Linux tools. There's always a way, but it may come down to
> how much time and effort you and your colleague are willing to devote to
> this.
> 
Loïc Prylli posted a C programm on the newsgroup fr.comp.os.linux some 2
years ago to detect an ext2 partition that can help to solve Jaldhar's problem.
This programm can be found on  but I don't know
the exact URL. If you can't find it, I have a copy of it


-- 
 ( >-   Laurent PICOULEAU  -< )
 /~\   [EMAIL PROTECTED]  /~\
|  \)Linux : mettez un pingouin dans votre ordinateur !(/  |
 \_|_Seuls ceux qui ne l'utilisent pas en disent du mal.   _|_/