Re: Help!!! undelete for ext3fs!!!
On Fri, Mar 01, 2002 at 06:28:30PM -0600, Cheryl Homiak wrote: > Well, it really is too late now, as this was my root partition and I > couldn't unmount it immediately even if I had known what to do. I had > already looked at Midnight commander but your additions were helpful as I > only saw the information about undeleting from the command line. The > information wasn't life-or-death and I learned a lot in the process. As > for backups, I'm really sorry but i can't figure out what a MO disk is. > Unfortunately, the only facilities I have right now for doing backup of > any kind is the old floppy, and I probably should have had this data on > floppy. I'd love to have a backup system, and you'll get no argument from > me against its importance, but the reality is that I don't have one right > now. No, it isn't. For "backups" that prevent against accidental erasure of a file, do a "man rcsintro" if you are only worried about text files, and man cvs if you have to work with binary files. > This incident also points out the wisdom in having your linux system > mounted on several partitions so that in cases like this you can unmount > the partition immediately. > As for the trash can, it wouldn't do any good if your hard disk breaks but > could be an asset in momentarily slips of the fingers (or the brain) such > as I had. Disks don't go bad nearly as often as people have thinkos. -- Share and Enjoy.
Re: Help!!! undelete for ext3fs!!!
On Sun, Mar 03, 2002 at 09:22:14PM +0100, Paul Seelig wrote: > [EMAIL PROTECTED] (Brian Potkin) writes: > > > The man page for Midnight Commander claims that undeletion is possible > > only with an ext2 file system. Your suggestion to explore whether it > > would deal with ext3 is reasonable but doesn't mc use debugfs which is > > designed for an ext2 file system? > > > Writing from the perspective of an up to date Debian/unstable system > only (i really can't be bothered with this rotten potato anymore): > > debugfs is part of the e2fsprogs package which in turn is ext3-aware. I took what the man page for mc said at face value and didn't dig any further to look in detail at the e2fsprogs documentation. Thanks for the correction; it gives me some incentive to make an ext3 partition and test how debugfs deals with deleted files on it. > > I was aware that Midnight Commander has the facility you describe so I > > used it. It told me it was `loading deleted files information' and was > > still going strong after an hour. I went to bed, dreamt of inodes, got > > up and there it was still churning away. > > > Having become curious after writing my message, i tried this as well > on an ext3 filesystem with similar effect. But i was not patient > enough to stand the procedure for more than an hour... ;-) This behaviour appears to be a bug in mc and has been reported in bug report #121917. > > Now that partition only has > > about 50M of free space so I suspect there is insufficient room to write > > the undeleted files to it. > > > Even if you wanted to, you simply couldn't and you better wouldn't, > even if you could because you wouldn't want to use those unlinked > inodes to be overwritten by "restoring" your files. > > The last time i succesfully undeleted using MC (almost two years ago) > i tried this and the undeletion routine refused writing data onto the > same partition. A couple of hours after making this statement it struck me that writing to an unmounted partition is not likely to succeed. > > A way to direct the file listing somewhere > > else would be useful. > > > What should this be good for? Not much! Basically, I was having difficulty understanding mc's behaviour and not having used it for this purpose before I made the mistake of assuming it was copying the files and required room to write them out somewhere. Brian.
Re: Help!!! undelete for ext3fs!!!
[EMAIL PROTECTED] (Brian Potkin) writes: > The man page for Midnight Commander claims that undeletion is possible > only with an ext2 file system. Your suggestion to explore whether it > would deal with ext3 is reasonable but doesn't mc use debugfs which is > designed for an ext2 file system? > Writing from the perspective of an up to date Debian/unstable system only (i really can't be bothered with this rotten potato anymore): debugfs is part of the e2fsprogs package which in turn is ext3-aware. > I was aware that Midnight Commander has the facility you describe so I > used it. It told me it was `loading deleted files information' and was > still going strong after an hour. I went to bed, dreamt of inodes, got > up and there it was still churning away. > Having become curious after writing my message, i tried this as well on an ext3 filesystem with similar effect. But i was not patient enough to stand the procedure for more than an hour... ;-) > Now that partition only has > about 50M of free space so I suspect there is insufficient room to write > the undeleted files to it. > Even if you wanted to, you simply couldn't and you better wouldn't, even if you could because you wouldn't want to use those unlinked inodes to be overwritten by "restoring" your files. The last time i succesfully undeleted using MC (almost two years ago) i tried this and the undeletion routine refused writing data onto the same partition. > A way to direct the file listing somewhere > else would be useful. > What should this be good for? > Imagine a lot of .deb files. Imagine having to rename them correctly! > The tedium involved, however, is very much offset by the pleasure of > recovering them. > I'm feeling with you. ;-) > Eventually I used the recover package from the testing distribution. > You can select deleted files by date and time of deletion and dump them > to a directory on another partition. It was also quite quick. Having > read about the difficulty of undeleting files on unix systems I found > the performance of this program impressive. > Thanks for the hint! I wasn't aware about the usefulness of this! :-) Thanks, P. *8^) -- Paul Seelig <[EMAIL PROTECTED]> -- African Music Archive - Institute for Ethnology and Africa Studies Johannes Gutenberg-University - Forum 6 - 55099 Mainz/Germany - http://ntama.uni-mainz.de --
Re: Help!!! undelete for ext3fs!!!
[EMAIL PROTECTED] (Cheryl Homiak) writes: > Well, it really is too late now, as this was my root partition and I > couldn't unmount it immediately even if I had known what to do. > Maybe you could still save some fragments of the file? or if you are *really* lucky, the relvant inodes still have not been overwritten? In such cases it's nice to have another Linux system on removable media like a CD-R or similar. This way you could have simply rebooted from this second system and repair from there. There is a *very* nice full Debian live system on a single CD-R which runs directly from CD without the need of an installation called KNOPPIX. Boots right into a full featured KDE session with full access of hundreds of applications. Check out "http://www.knopper.net/knoppix/"; to learn more about it. I use it as full featured rescue disk and installation media for new desktop installations. > for backups, I'm really sorry but i can't figure out what a MO disk > is. > This is a magneto optical disk. It is similar to ZIP and floppy disks in size but has capacities from 128 MB up to 2.3 GB and is virtually undestroyable by magnetic influences, etc. There exist 5.25" disks and drives with capacities up to 9.1GB as well. MO is IMHO the only really safe way for storing any data, albeit not very widespread and the drives tend to be quite costly. But one can easily aquire older models at eBay for cheaper prices. That's what i did. I have a 5.2GB drive from Sony and a 640MB drive from Fujitsu. ;-) For more information, check out "http://mo.fujitsu.com/global/";, "http://www.sony-cp.com/_E/Products/Storage/MO/rmo-s551.html";, "http://www.sony-cp.com/_E/Products/Storage/MO/Index.html";, and "http://www.olympus-europa.com/mo/";. Maybe a CD-RW might be of some practical use, but what i like so much about MO disks is that one can use them like any other file system. > This incident also points out the wisdom in having your linux system > mounted on several partitions so that in cases like this you can unmount > the partition immediately. > Just take into account that such deep "wisdom" shouldn't force it's cleverness upon oneself and become impractical. The only file system layout i'd bother about for a desktop machine would consist of only three partions. One each for "swap space", "/" and "/home/". Just for private use, anything else would be only overkill. If you don't mind reinstalling programs from Debian packages, backups should only be made regularily from "/etc/", "/home/" and "/var/". But restoring (and cloning!) a system from a full backup might save quite some time in case of an actual incident. > As for the trash can, it wouldn't do any good if your hard disk breaks but > could be an asset in momentarily slips of the fingers (or the brain) such > as I had. > Yes, in this case it might prove to be useful. Generally, it's a good idea *not* to trust oneself. Therefore it's as well a bad idea to work only as the super user. Been there, done that, suffered from the consequences, and, rightfully so, got no t-shirt. ;-) Cheers, P. *8^) -- Paul Seelig <[EMAIL PROTECTED]> -- African Music Archive - Institute for Ethnology and Africa Studies Johannes Gutenberg-University - Forum 6 - 55099 Mainz/Germany - http://ntama.uni-mainz.de --
Re: Help!!! undelete for ext3fs!!!
On Fri, Mar 01, 2002 at 08:38:05PM +0100, Paul Seelig wrote: > On Thu, Feb 28, 2002 at 11:42:36PM -0600, Cheryl Homiak wrote: > > > I just deleted something I didn't want to delete; won't hurt my system, > > just destroyed some important records I was keeping. > > > *Immediately* unmount the partition holding this data! With > "*immediately*" i mean *IMMEDIATELY!*, or better put, RIGHT *NOW*! > > An now let's just calm down to be able to think for a minute. A few days ago my fingers typed the command `apt-get clean'. What my brain intended was `apt-get autoclean'. Fortunately, I keep package files on a separate ext2 partition so unmounting it was quick and easy. I realise the deleted data are replaceable but 400M+ takes a long time to download on a modem link so I took the opportunity to have a look at how easy or hard it was to recover the files. If I failed to get them back it wouldn't be disastrous but it was annoying to have made a mistake with a command I was familiar with. > > Is there any way to undelete in ext3fs? > > > Since this is compatible with ext2, ext2 undeletion should be > possible. Now you have the possibility to find out yourself and tell > us whether this worked or not. The man page for Midnight Commander claims that undeletion is possible only with an ext2 file system. Your suggestion to explore whether it would deal with ext3 is reasonable but doesn't mc use debugfs which is designed for an ext2 file system? > There is a comfortable way for undeletion using the GNU Midnight > Commander, "/usr/bin/mc". If you have it installed, then start it up, > press "F9" and choose "Command | Undelete files (ext2fs only)". > > Enter the device file name without the leading "/dev/" of the > (hopefully unmounted!) partition containing the deleted files and > wait a few minutes until the panel contains a listing of deleted > files. Depending on size of the partition in question, this can take > up a considerable amount of time. So please be patient even if this > takes half an hour or even far more. I was aware that Midnight Commander has the facility you describe so I used it. It told me it was `loading deleted files information' and was still going strong after an hour. I went to bed, dreamt of inodes, got up and there it was still churning away. Now that partition only has about 50M of free space so I suspect there is insufficient room to write the undeleted files to it. A way to direct the file listing somewhere else would be useful. > The files in the resulting list don't carry names anymore and the > shown names are probably mere inode numbers(?) or similar. Check > which file(s) might contain the data in question and copy this file > into a directory located on *another* partition. Imagine a lot of .deb files. Imagine having to rename them correctly! The tedium involved, however, is very much offset by the pleasure of recovering them. > And if you've been able to save your data: Rejoice! Eventually I used the recover package from the testing distribution. You can select deleted files by date and time of deletion and dump them to a directory on another partition. It was also quite quick. Having read about the difficulty of undeleting files on unix systems I found the performance of this program impressive. [Snip good advice on backups] Brian.
Re: Help!!! undelete for ext3fs!!!
On Fri, Mar 01, 2002 at 06:28:30PM -0600, Cheryl Homiak wrote: > [snip] As > for backups, I'm really sorry but i can't figure out what a MO disk is. I think this is tech speak for a magneto-optical disk, which is a rare beast that I've never actually seen, only heard about. You may google the web for more info about them. > Unfortunately, the only facilities I have right now for doing backup of > any kind is the old floppy, and I probably should have had this data on > floppy. Take it from someone who lived in DOS World for over ten years, floppy backup is about as good as no backup at all. Maybe worse, since you might have a false sense of security. Floppies are hideously unreliable, and just too small to back up present-day large hard disks. The only thing I use floppies for nowadays is to pass small files to friends who don't have Net connections, and for emergency boot disks. And I always make *three* of those at a crack, since I'm as likely to find a corrupted sector on the diskette when I need it as I am to boot a kernel. They like to fail at the most inconvenient times. > I'd love to have a backup system, and you'll get no argument from > me against its importance, but the reality is that I don't have one right > now. CD-Rs work okay for people who don't have large amounts of data to back up, and they are an inexpensive solution. For large amounts of data, tape, preferably SCSI, would seem to be a common recommendation from the old hands on Linux lists. Problem is that a drive that can back up a large disk won't be cheap. Add the cost of a set of tapes to rotate backups, and the cost of a good SCSI board if you don't already have a SCSI channel on your machine, and you're talking a good chunk of change. I use a poor man's remedy: I back up to my second hard drive. This is a "cold swap" IDE drive. I have one disk in the bay to which I back up, and two extra to rotate. One is always off-site at my locker at work, and I tote them back and forth when I go to work to rotate the backups. Since the backups are compressed, and I don't back up anything I can recreate from my Debian installation CDs, I can get away with smaller drives for the backup bay than for the primary disk. The backup disks have either been cannibalized from older systems, or bought for cheap at used computer shops. Not an ideal solution, by any means, but it "works" for some values of "works". At least I can back up everything that needs backing up on a single medium, so unattended backups are possible, and the disk-to-disk transfers are pretty fast. And it was a lot cheaper than DDS. Just $0.02 worth. Cordially, Mark S. Reglewski
Re: Help!!! undelete for ext3fs!!!
Well, it really is too late now, as this was my root partition and I couldn't unmount it immediately even if I had known what to do. I had already looked at Midnight commander but your additions were helpful as I only saw the information about undeleting from the command line. The information wasn't life-or-death and I learned a lot in the process. As for backups, I'm really sorry but i can't figure out what a MO disk is. Unfortunately, the only facilities I have right now for doing backup of any kind is the old floppy, and I probably should have had this data on floppy. I'd love to have a backup system, and you'll get no argument from me against its importance, but the reality is that I don't have one right now. This incident also points out the wisdom in having your linux system mounted on several partitions so that in cases like this you can unmount the partition immediately. As for the trash can, it wouldn't do any good if your hard disk breaks but could be an asset in momentarily slips of the fingers (or the brain) such as I had. If anybody does try this with the ext3fs, I would be very interested in a post re: the results. thanks to everybody for their suggestions; I also discovered the undeletion howto and the recovery program due to a combination of my own searching and people's comments. By the way, I learned before i ever started linux that panic is the surest way to complicate an already bad situation, so that was never an issue. -- Cheryl
Re: Help!!! undelete for ext3fs!!!
Lo, on Friday, March 1, Jeff did write: > Ulf Rompe, 2002-Mar-01 10:25 +0100: > > > > alias rm = 'mv --backup=numbered --target-directory=/tmp/Trashcan' > > > > This is nice, and I'm starting to use this from my root and user > account on my laptop. > > However, how would I delete from the Trashcan, save removing the > alias temporarily? /bin/rm /tmp/Trashcan/ Specifying the full path blocks alias/function expansion. Richard
Re: Help!!! undelete for ext3fs!!!
Jeff <[EMAIL PROTECTED]> writes: > > Ulf Rompe, 2002-Mar-01 10:25 +0100: > > > > alias rm = 'mv --backup=numbered --target-directory=/tmp/Trashcan' > > > > This is nice, and I'm starting to use this from my root and user > account on my laptop. > > However, how would I delete from the Trashcan, save removing the > alias temporarily? ``/bin/rm'' or ``\rm'' will execute th rm binary, not the alias. Bob -- _ |_) _ |_ Robert D. Hilliard <[EMAIL PROTECTED]> |_) (_) |_) 1294 S.W. Seagull Way <[EMAIL PROTECTED]> Palm City, FL USA GPG Key ID: 390D6559 PGP Key ID: A8E40EB9
Re: Help!!! undelete for ext3fs!!!
On Fri, Mar 01, 2002 at 10:12:51AM -0800, Jeff wrote: > Ulf Rompe, 2002-Mar-01 10:25 +0100: > > > > alias rm = 'mv --backup=numbered --target-directory=/tmp/Trashcan' > > > > This is nice, and I'm starting to use this from my root and user > account on my laptop. > > However, how would I delete from the Trashcan, save removing the > alias temporarily? Specify the full path to the rm command, as this prevents alias substitution: $ /bin/rm filename -- Karl E. Jørgensen [EMAIL PROTECTED] www.karl.jorgensen.com /"\ \ / ASCII Ribbon Campaign x - Say NO to HTML in email / \ - Say NO to Word documents in email (and Macros!) pgpvFP1v47Efk.pgp Description: PGP signature
Re: Help!!! undelete for ext3fs!!!
On Thu, Feb 28, 2002 at 11:42:36PM -0600, Cheryl Homiak wrote: > I just deleted something I didn't want to delete; won't hurt my system, > just destroyed some important records I was keeping. > *Immediately* unmount the partition holding this data! With "*immediately*" i mean *IMMEDIATELY!*, or better put, RIGHT *NOW*! An now let's just calm down to be able to think for a minute. > Is there any way to undelete in ext3fs? > Since this is compatible with ext2, ext2 undeletion should be possible. Now you have the possibility to find out yourself and tell us whether this worked or not. There is a comfortable way for undeletion using the GNU Midnight Commander, "/usr/bin/mc". If you have it installed, then start it up, press "F9" and choose "Command | Undelete files (ext2fs only)". Enter the device file name without the leading "/dev/" of the (hopefully unmounted!) partition containing the deleted files and wait a few minutes until the panel contains a listing of deleted files. Depending on size of the partition in question, this can take up a considerable amount of time. So please be patient even if this takes half an hour or even far more. The files in the resulting list don't carry names anymore and the shown names are probably mere inode numbers(?) or similar. Check which file(s) might contain the data in question and copy this file into a directory located on *another* partition. And if you've been able to save your data: Rejoice! > And if there is a way, but you had to have it pre-set up before the > catastrophe occurred, I'd still like to know about it so I will have a > safeguard in the future. > The only true safeguard is a regular backup. Other good possibilities include a regular backup or possibly even a regular backup. Some people even go so far to claim that a regular backup is the only worthwhile protection system because it transcends the limits of you hard disk and computer live span. Among the multitude of choices just presented i'd always favour a regular backup. ;-) I wouldn't bother about a trash can facility because if your hard disk breaks your trash can will be broken too. Backups don't get broken when your hard disk fails *and* when made on secure media like MO disks (that's what i use and trust). If the data in question is *really* important i'd take responsibility to store various generations of backup media in another room, floor, building or even city. Linus himself and most Free Software developers even chose to spread their data over various continents... ;-) Good luck, P. *8^) -- If not specific to HP please always reply to "Paul Seelig <[EMAIL PROTECTED]>"
Re: Help!!! undelete for ext3fs!!!
Ulf Rompe, 2002-Mar-01 10:25 +0100: > > alias rm = 'mv --backup=numbered --target-directory=/tmp/Trashcan' > This is nice, and I'm starting to use this from my root and user account on my laptop. However, how would I delete from the Trashcan, save removing the alias temporarily? thanks, jc -- Jeff CoppockSystems Engineer Diggin' Debian Admin and User
Re: Help!!! undelete for ext3fs!!!
Sebastiaan <[EMAIL PROTECTED]> writes:
>> Is there any way to undelete in ext3fs?
I'm not shure if this works but I would give the normale "recover" for
ext2 a try. Before using it you should umount the partition. And in
the meantime you should use the partition read-only to get a chance
that the deleted inodes aren't assigned to new files.
> You can setup some kind of Trashcan yourself. Make a directory on your
> system somewhere and make an alias for rm:
> alias rm = 'mv ? /tmp/Trashcan'
alias rm = 'mv --backup=numbered --target-directory=/tmp/Trashcan'
If you want to use a parameter within aliases, you have to use
functions instead:
function rm { mv $* /tmp/Trashcan }
Obviously, all this only works in Bourne Shell derivates like bash.
> If you are on a multiuser system, you definitely have to write a
> script, which moves the deleted files into subdirs in the Trashcan
> which are unreadable by other users.
alias rm = 'mkdir -m 0700 -p /tmp/Trashcan/$USER && \
mv --backup=numbered --target-directory=/tmp/Trashcan/$USER'
[x] ulf
--
Der Mensch ist immer noch der beste Computer. (John F. Kennedy)
Re: Help!!! undelete for ext3fs!!!
hi ya dumb question/comment... since ext3 is just ext2 w/ journalling... - can you just unplay the journal ??? :-) otherwise to undelete ext2 files... and if you did undelete it successfullye... i donno what happens to your journaled fs http://www.Linux-Sec.net/Txt/erase.txt ( look for restore deleted files ) aliasing rm is a sorta whacky way to solve some of the accidental delete problems.. have fun linuxing alvin On Fri, 1 Mar 2002, Sebastiaan wrote: > High, > > On Thu, 28 Feb 2002, Cheryl Homiak wrote: > > > I just deleted something I didn't want to delete; won't hurt my system, > > just destroyed some important records I was keeping. > > Is there any way to undelete in ext3fs? > Ouch, no idea. > > > And if there is a way, but you had to have it pre-set up before the > > catastrophe occurred, I'd still like to know about it so I will have a > > safeguard in the future. > > You can setup some kind of Trashcan yourself. Make a directory on your > system somewhere and make an alias for rm: > alias rm = 'mv ? /tmp/Trashcan' >
Re: Help!!! undelete for ext3fs!!!
I did this, once but it was a pain. It was under ext2 instead of ext3 but that shouldn't matter in this case. It also required knowledge of some of the contents of the file and wasn't very useful for binary files. You essentially boot without mounting the filesystem on which you want to 'undelete' (or you unmount after boot if not the root partition and after killing all daemons that use the target filesystem). Then you grep the device (eg /dev/sdb1) for some part of the file you want and have it spew so many bytes before and after what you are looking for so that you can see where the start/stop of the file is. Once you have that you use a comand (dd? or something) to copy those bytes from that location on the device to a file on an already mounted file system and poof, you have it back. I know this is rather vague but you get the idea of the approach. I wish I could give you more detail but I did this around 4 years ago and haven't really needed to do much like it since. vec - Original Message - From: "Sebastiaan" <[EMAIL PROTECTED]> To: "Cheryl Homiak" <[EMAIL PROTECTED]> Cc: Sent: Friday, March 01, 2002 12:19 AM Subject: Re: Help!!! undelete for ext3fs!!! > High, > > On Thu, 28 Feb 2002, Cheryl Homiak wrote: > > > I just deleted something I didn't want to delete; won't hurt my system, > > just destroyed some important records I was keeping. > > Is there any way to undelete in ext3fs? > Ouch, no idea. > > > And if there is a way, but you had to have it pre-set up before the > > catastrophe occurred, I'd still like to know about it so I will have a > > safeguard in the future. > > You can setup some kind of Trashcan yourself. Make a directory on your > system somewhere and make an alias for rm: > alias rm = 'mv ? /tmp/Trashcan' > > not sure about the ? which should be the filename. Or write a script for > this. If you are on a multiuser system, you definitely have to write a > script, which moves the deleted files into subdirs in the Trashcan which > are unreadable by other users. > > Greetz, > Sebastiaan > > > > -- > To UNSUBSCRIBE, email to [EMAIL PROTECTED] > with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED] >
Re: Help!!! undelete for ext3fs!!!
High, On Thu, 28 Feb 2002, Cheryl Homiak wrote: > I just deleted something I didn't want to delete; won't hurt my system, > just destroyed some important records I was keeping. > Is there any way to undelete in ext3fs? Ouch, no idea. > And if there is a way, but you had to have it pre-set up before the > catastrophe occurred, I'd still like to know about it so I will have a > safeguard in the future. You can setup some kind of Trashcan yourself. Make a directory on your system somewhere and make an alias for rm: alias rm = 'mv ? /tmp/Trashcan' not sure about the ? which should be the filename. Or write a script for this. If you are on a multiuser system, you definitely have to write a script, which moves the deleted files into subdirs in the Trashcan which are unreadable by other users. Greetz, Sebastiaan
Help!!! undelete for ext3fs!!!
I just deleted something I didn't want to delete; won't hurt my system, just destroyed some important records I was keeping. Is there any way to undelete in ext3fs? And if there is a way, but you had to have it pre-set up before the catastrophe occurred, I'd still like to know about it so I will have a safeguard in the future. I can only find references to undeletion for ext2fs. TIA. -- Cheryl
