Re: [CentOS] Restoring deleted files.

2013-08-17 Thread Ahmed
On 08/17/2013 06:57 AM, Ljubomir Ljubojevic wrote:
> On 08/16/2013 06:44 PM, Ahmed wrote:
>> Hi,
>>
>>is it possible to Restore files deleted with " rm rf " from ext4 or
>> ext3 filesystem by mistake.
>>
> I posted this as a Document in official CentOS Facebook group. Feel free
> to use it in a blog, just mention my name:
>
> Recover files from ext3/ext4 ext4magic
>
> How to recover deleted files:
> I used ext4 magic, replacement for extundelete and ext3grep:
> http://openfacts2.berlios.de/wikien/index.php/BerliosProject:Ext4magic
>
> I have rpm's for CentOS 6 I downloaded from somewhere at:
> http://rpms.plnet.rs/plnet-centos6-i386/RPMS.plnet-downloaded/ext4magic-0.3.1-1.2.i686.rpm
> http://rpms.plnet.rs/plnet-centos6-x86_64/RPMS.plnet-downloaded/ext4magic-0.3.1-1.2.x86_64.rpm
>
> What to do:
>
> 1. First thing to do is to unmount that partition and stop using it. If
> it is root partition, shutdown system and boot LiveCD/LiveDVD 6.x and
> work from it
>
> 2. Create a copy of your partition (to a filesystem where you have
> enough free space!):
> dd if=/dev/DEVICE of=/BACKUPPATH/DEVICE.img
>
> 3. Create a backup of ext3/ext4 Journal:
> debugfs -R "dump <8> /BACKUPPATH/journal.copy" /dev/DEVICE
>
> 4. Download and install ext4magic rpm:
>
> CentOS i386 - for 32-bit system/LiveCD:
> wget
> http://rpms.plnet.rs/plnet-centos6-i386/RPMS.plnet-downloaded/ext4magic-0.3.1-1.2.i686.rpm
> yum install ext4magic-0.3.1-1.2.i686.rpm
>
> CentOS 6 x86_64:
> wget
> http://rpms.plnet.rs/plnet-centos6-x86_64/RPMS.plnet-downloaded/ext4magic-0.3.1-1.2.x86_64.rpm
> yum install ext4magic-0.3.1-1.2.x86_64.rpm
>
> 5a. Run ext4magic on the copy/dd-image to recover all deleted files (-m
> switch):
>
> ext4magic /BACKUPPATH/DEVICE.img -m -j /BACKUPPATH/journal.copy
>
> 5b. Run ext4magic on the actual partition (not recomended!):
>
> ext4magic /dev/DEVICE -j /BACKUPPATH/journal.copy -m
>
> 5c. Recovers all files deleted the last 24 hours from directory user1/
> which have the string jpg in their filename. The recovered files are
> stored at /LOCATION_TO_SAVE_FILES. A temporary file ./tmpfile is used to
> get the list of filenames to recover. :
>
> ext4magic /BACKUPPATH/DEVICE.img -Lx -f user1 | grep "jpg" > ./tmpfile
> ext4magic /BACKUPPATH/DEVICE.img -i ./tmpfile -r -d /LOCATION_TO_SAVE_FILES
>
> 5d. Since the files were delete 4 days ago, I decided to R recover
> (everything) after 5 days ago and before 2 days ago:
>
> ext4magic -R -a $(date -d “-5day” +%s) -b $(date -d “-2day” +%s) \ -d
> /LOCATION_TO_SAVE_FILES /BACKUPPATH/DEVICE.img
>
> More help:
> http://source.kohlerville.com/2013/02/ext4-recover-deleted-files-undelete-using-ext4magic-on-centos-6/
>
>
>
>
>
Thank you so much for the hardwork and contribution made by all the 
people to solve the problem at hand.  wishing all the best to you guys. 
I learn a lot here.
Kind Regards
Ahmad Dawood

___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


Re: [CentOS] Restoring deleted files.

2013-08-16 Thread Ljubomir Ljubojevic
On 08/16/2013 06:44 PM, Ahmed wrote:
> Hi,
>
>   is it possible to Restore files deleted with " rm rf " from ext4 or
> ext3 filesystem by mistake.
>

I posted this as a Document in official CentOS Facebook group. Feel free 
to use it in a blog, just mention my name:

Recover files from ext3/ext4 ext4magic

How to recover deleted files:
I used ext4 magic, replacement for extundelete and ext3grep:
http://openfacts2.berlios.de/wikien/index.php/BerliosProject:Ext4magic

I have rpm's for CentOS 6 I downloaded from somewhere at:
http://rpms.plnet.rs/plnet-centos6-i386/RPMS.plnet-downloaded/ext4magic-0.3.1-1.2.i686.rpm
http://rpms.plnet.rs/plnet-centos6-x86_64/RPMS.plnet-downloaded/ext4magic-0.3.1-1.2.x86_64.rpm

What to do:

1. First thing to do is to unmount that partition and stop using it. If 
it is root partition, shutdown system and boot LiveCD/LiveDVD 6.x and 
work from it

2. Create a copy of your partition (to a filesystem where you have 
enough free space!):
dd if=/dev/DEVICE of=/BACKUPPATH/DEVICE.img

3. Create a backup of ext3/ext4 Journal:
debugfs -R "dump <8> /BACKUPPATH/journal.copy" /dev/DEVICE

4. Download and install ext4magic rpm:

CentOS i386 - for 32-bit system/LiveCD:
wget 
http://rpms.plnet.rs/plnet-centos6-i386/RPMS.plnet-downloaded/ext4magic-0.3.1-1.2.i686.rpm
yum install ext4magic-0.3.1-1.2.i686.rpm

CentOS 6 x86_64:
wget 
http://rpms.plnet.rs/plnet-centos6-x86_64/RPMS.plnet-downloaded/ext4magic-0.3.1-1.2.x86_64.rpm
yum install ext4magic-0.3.1-1.2.x86_64.rpm

5a. Run ext4magic on the copy/dd-image to recover all deleted files (-m 
switch):

ext4magic /BACKUPPATH/DEVICE.img -m -j /BACKUPPATH/journal.copy

5b. Run ext4magic on the actual partition (not recomended!):

ext4magic /dev/DEVICE -j /BACKUPPATH/journal.copy -m

5c. Recovers all files deleted the last 24 hours from directory user1/ 
which have the string jpg in their filename. The recovered files are 
stored at /LOCATION_TO_SAVE_FILES. A temporary file ./tmpfile is used to 
get the list of filenames to recover. :

ext4magic /BACKUPPATH/DEVICE.img -Lx -f user1 | grep "jpg" > ./tmpfile
ext4magic /BACKUPPATH/DEVICE.img -i ./tmpfile -r -d /LOCATION_TO_SAVE_FILES

5d. Since the files were delete 4 days ago, I decided to R recover 
(everything) after 5 days ago and before 2 days ago:

ext4magic -R -a $(date -d “-5day” +%s) -b $(date -d “-2day” +%s) \ -d 
/LOCATION_TO_SAVE_FILES /BACKUPPATH/DEVICE.img

More help:
http://source.kohlerville.com/2013/02/ext4-recover-deleted-files-undelete-using-ext4magic-on-centos-6/





-- 
Ljubomir Ljubojevic
(Love is in the Air)
PL Computers
Serbia, Europe

StarOS, Mikrotik and CentOS/RHEL/Linux consultant
___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


Re: [CentOS] Restoring deleted files.

2013-08-16 Thread Johan Vermeulen
Hello,

I think the commandline filemanager can reunite you with deleted files.

Greetings, j.

Clive Hills schreef:

>There's also PhotoRec included in the testdisk package.
>
>
>Clive
>
>
>On Fri, Aug 16, 2013 at 6:25 PM, Joseph Spenner wrote:
>
>> >From: Ahmed 
>>
>> >To: CentOS mailing list 
>> >Sent: Friday, August 16, 2013 9:44 AM
>> >Subject: [CentOS] Restoring deleted files.
>>
>> >
>> >Hi,
>> >
>> > is it possible to Restore files deleted with " rm rf " from ext4 or
>> > ext3 filesystem by mistake.
>>
>> There is something called lazarus:
>>
>> http://www.fish2.com/tct/help-recovering-file
>>
>> Make backups!   I recommend bacula.   :)
>>
>> __
>> If life gives you lemons, keep them-- because hey.. free lemons.
>> "♥ Sticker" fixer:  http://microflush.org/stuff/stickers/heartFix.html
>> ___
>> CentOS mailing list
>> CentOS@centos.org
>> http://lists.centos.org/mailman/listinfo/centos
>>
>
>
>
>-- 
>Clive
> -- 077222971491
>___
>CentOS mailing list
>CentOS@centos.org
>http://lists.centos.org/mailman/listinfo/centos
___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


Re: [CentOS] Restoring deleted files.

2013-08-16 Thread Clive Hills
There's also PhotoRec included in the testdisk package.


Clive


On Fri, Aug 16, 2013 at 6:25 PM, Joseph Spenner wrote:

> >From: Ahmed 
>
> >To: CentOS mailing list 
> >Sent: Friday, August 16, 2013 9:44 AM
> >Subject: [CentOS] Restoring deleted files.
>
> >
> >Hi,
> >
> > is it possible to Restore files deleted with " rm rf " from ext4 or
> > ext3 filesystem by mistake.
>
> There is something called lazarus:
>
> http://www.fish2.com/tct/help-recovering-file
>
> Make backups!   I recommend bacula.   :)
>
> __
> If life gives you lemons, keep them-- because hey.. free lemons.
> "♥ Sticker" fixer:  http://microflush.org/stuff/stickers/heartFix.html
> ___
> CentOS mailing list
> CentOS@centos.org
> http://lists.centos.org/mailman/listinfo/centos
>



-- 
Clive
 -- 077222971491
___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


Re: [CentOS] Restoring deleted files.

2013-08-16 Thread Joseph Spenner
>From: Ahmed 

>To: CentOS mailing list  
>Sent: Friday, August 16, 2013 9:44 AM
>Subject: [CentOS] Restoring deleted files.
 
>
>Hi,
>
>     is it possible to Restore files deleted with " rm rf " from ext4 or 
> ext3 filesystem by mistake.

There is something called lazarus:

http://www.fish2.com/tct/help-recovering-file

Make backups!   I recommend bacula.   :)

__
If life gives you lemons, keep them-- because hey.. free lemons.
"♥ Sticker" fixer:  http://microflush.org/stuff/stickers/heartFix.html
___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


Re: [CentOS] Restoring deleted files.

2013-08-16 Thread Frank Cox
On Fri, 16 Aug 2013 21:44:11 +0500
Ahmed wrote:

>  is it possible to Restore files deleted with " rm rf " from ext4 or 
> ext3 filesystem by mistake.

There are several programs and procedures that show up on a google search for
"undelete ext4" and "undelete ext3".  Have you looked at and/or tried those?

-- 
MELVILLE THEATRE ~ Real D 3D Digital Cinema ~ www.melvilletheatre.com
___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos


[CentOS] Restoring deleted files.

2013-08-16 Thread Ahmed
Hi,

 is it possible to Restore files deleted with " rm rf " from ext4 or 
ext3 filesystem by mistake.

Regards
Ahmad
___
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos