Re: Update - was {Re: Recovering accidentally deleted file folder}

2017-10-20 Thread Richard Owlett 

On 10/18/2017 02:09 PM, Richard Owlett wrote:

On 10/18/2017 11:04 AM, Richard Owlett wrote:

I had posted:


It wasn't backed up - will have to follow advice advice I've given
others ;/

I've not done file recovery since early days of WinXP.

On the affected machine I'm running Stretch(9.1) with Mate desktop.

The affected folders are on a partition normally mounted by a line
in fstab.


I immediately shut down.
There is another instance of Debian on a separate partition.

Logging in as root I edited fstab commenting out the appropriate line.


I feel the the data is still valid - there is just no appropriate
directory entries for the affected folder and its sub-directories.




I have copied the partition to another partition (using dd).
The critical data in the deleted  folder(s) was my SeaMonkey profile.
I discovered I did have a several months old backup of the profile.
I am now running Squeeze  (9.1) from a fresh install and installed the
latest SeaMonkey on it.

Several packages in the Debian repository have been suggested. I will
download their man-pages and will try them.

Several forensic packages have also been suggested which will used if
required.

Thanks for the help.


I did "extundelete --restore-all /dev/sdaNN".
It apparently worked while stating it could not restore several files.
SeaMonkey was unhappy with the results -- giving an error message
suggestive of permission problem(s).
That is still progress, before SeaMonkey would not start.
I'll have to take a break and work out a reasonable diagnostic routine.
Thanks again.



Having enough space on my HDD I added a fresh install of Stretch with a 
fresh copy of SeaMonkey. I then copied the critical SeaMonkey profile 
from the restored image to folder with profiles on new the new install 
and added it to profiles.ini . SeaMonkey had no problem with it.

Re: Update - was {Re: Recovering accidentally deleted file folder}

2017-10-18 Thread Richard Owlett 

On 10/18/2017 11:04 AM, Richard Owlett wrote:

I had posted:


It wasn't backed up - will have to follow advice advice I've given
others ;/

I've not done file recovery since early days of WinXP.

On the affected machine I'm running Stretch(9.1) with Mate desktop.

The affected folders are on a partition normally mounted by a line
in fstab.


I immediately shut down.
There is another instance of Debian on a separate partition.

Logging in as root I edited fstab commenting out the appropriate line.


I feel the the data is still valid - there is just no appropriate
directory entries for the affected folder and its sub-directories.




I have copied the partition to another partition (using dd).
The critical data in the deleted  folder(s) was my SeaMonkey profile.
I discovered I did have a several months old backup of the profile.
I am now running Squeeze  (9.1) from a fresh install and installed the
latest SeaMonkey on it.

Several packages in the Debian repository have been suggested. I will
download their man-pages and will try them.

Several forensic packages have also been suggested which will used if
required.

Thanks for the help.


I did "extundelete --restore-all /dev/sdaNN".
It apparently worked while stating it could not restore several files.
SeaMonkey was unhappy with the results -- giving an error message 
suggestive of permission problem(s).

That is still progress, before SeaMonkey would not start.
I'll have to take a break and work out a reasonable diagnostic routine.
Thanks again.

Update - was {Re: Recovering accidentally deleted file folder}

2017-10-18 Thread Richard Owlett 

I had posted:


It wasn't backed up - will have to follow advice advice I've given
others ;/

I've not done file recovery since early days of WinXP.

On the affected machine I'm running Stretch(9.1) with Mate desktop.

The affected folders are on a partition normally mounted by a line
in fstab.


I immediately shut down.
There is another instance of Debian on a separate partition.

Logging in as root I edited fstab commenting out the appropriate line.


I feel the the data is still valid - there is just no appropriate
directory entries for the affected folder and its sub-directories.




I have copied the partition to another partition (using dd).
The critical data in the deleted  folder(s) was my SeaMonkey profile.
I discovered I did have a several months old backup of the profile.
I am now running Squeeze  (9.1) from a fresh install and installed the 
latest SeaMonkey on it.


Several packages in the Debian repository have been suggested. I will 
download their man-pages and will try them.


Several forensic packages have also been suggested which will used if 
required.


Thanks for the help.

Re: Recovering accidentally deleted file folder

2017-10-17 Thread solitone 

On 16/10/17 17:43, tv.deb...@googlemail.com wrote:

package "testdisk"


Testdisk worked beautifully well for me

Re: Recovering accidentally deleted file folder

2017-10-17 Thread Hans 
Maybe you might want to take a look at packages like "foremost" or "scalpel".
You might want also to take a look at foresic live-cds like "Caine" or "DEFT".

And last but not least, look at this project:

http://www.r-tt.com/de/free_linux_recovery/

Good luck!

Hans

Re: Recovering accidentally deleted file folder

2017-10-17 Thread Jimmy Johnson 

On 10/16/2017 08:28 AM, Richard Owlett wrote:
It wasn't backed up - will have to follow advice  advice I've given 
others ;/

I've not done file recovery since early days of WinXP.

On the affected machine I'm running Stretch(9.1) with Mate desktop.
The affected folders are on a partition normally mounted by a line in 
fstab.


I immediately shut down.
There is another instance of Debian on a separate partition.
Logging in as root I edited fstab commenting out the appropriate line.

I feel the the data is still valid - there is just no appropriate 
directory entries for the affected folder and its sub-directories.


Guidance please.

TIA


I've used "testdisk" a couple of times, the last time I recovered a one 
TB drive and it pulled 1.6TB of stuff off of the drive, how because it 
will find all the partitions tables that have ever been installed. You 
may need to run testdisk from a cd or pen drive, you don't want to run 
it on a mounted drive and you need an external to save back what you 
want and it will take some time for it to find the stuff and for it to 
be coped back and of course depending on size of the drive. For me it 
was worth it and saved my files going back to the mid 90's.

--
Jimmy Johnson

Debian Buster - KDE Plasma 5.8.7 - AMD A8-7600 - EXT4 at sda7
Registered Linux User #380263

Re: Recovering accidentally deleted file folder

2017-10-16 Thread Dejan Jocic 
On 16-10-17, Richard Owlett wrote:
> It wasn't backed up - will have to follow advice  advice I've given others
> ;/
> I've not done file recovery since early days of WinXP.
> 
> On the affected machine I'm running Stretch(9.1) with Mate desktop.
> The affected folders are on a partition normally mounted by a line in fstab.
> 
> I immediately shut down.
> There is another instance of Debian on a separate partition.
> Logging in as root I edited fstab commenting out the appropriate line.
> 
> I feel the the data is still valid - there is just no appropriate directory
> entries for the affected folder and its sub-directories.
> 
> Guidance please.
> 
> TIA
> 

You can use scalpel, or foremost. Both work fine, both are packaged in
Debian. You can use them both on hard drives/partitions and on imaged
files.

Re: Recovering accidentally deleted file folder

2017-10-16 Thread tv.deb...@googlemail.com 

On 16/10/2017 21:00, Deltonos wrote:

You can try withy any distro that contains Sleuthkit+Autopsy:
https://www.sleuthkit.org/autopsy/

My advise is, if you can, make and image using dd from afected machine to
external HD  and work from another dedicated system to recover it (or you
can use and live distro like this one http://www.deftlinux.net/download/)

Regards.

2017-10-16 10:23 GMT-05:00 Richard Owlett :


It wasn't backed up - will have to follow advice  advice I've given others
;/
I've not done file recovery since early days of WinXP.

On the affected machine I'm running Stretch(9.1) with Mate desktop.
The affected folders are on a partition normally mounted by a line in
fstab.

I immediately shut down.
There is another instance of Debian on a separate partition.
Logging in as root I edited fstab commenting out the appropriate line.

I feel the the data is still valid - there is just no appropriate
directory entries for the affected folder and its sub-directories.

Guidance please.

TIA






Hi,
Image the partition or at least mount it ro, then depending on the 
file-system and the mime-type of the files you want to recover, you can 
try "extundelete" (ext3/4, man page is well documented), "photorec" (in 
package "testdisk", not limited to photo/image, provides  step-by-step 
guidance). As mentioned above if the "easy" way don't work you can 
resort to proper forensic tools, but they often have a steep learning curve.


Good luck.

Re: Recovering accidentally deleted file folder

2017-10-16 Thread Deltonos 
You can try withy any distro that contains Sleuthkit+Autopsy:
https://www.sleuthkit.org/autopsy/

My advise is, if you can, make and image using dd from afected machine to
external HD  and work from another dedicated system to recover it (or you
can use and live distro like this one http://www.deftlinux.net/download/)

Regards.

2017-10-16 10:23 GMT-05:00 Richard Owlett :

> It wasn't backed up - will have to follow advice  advice I've given others
> ;/
> I've not done file recovery since early days of WinXP.
>
> On the affected machine I'm running Stretch(9.1) with Mate desktop.
> The affected folders are on a partition normally mounted by a line in
> fstab.
>
> I immediately shut down.
> There is another instance of Debian on a separate partition.
> Logging in as root I edited fstab commenting out the appropriate line.
>
> I feel the the data is still valid - there is just no appropriate
> directory entries for the affected folder and its sub-directories.
>
> Guidance please.
>
> TIA
>
>

Recovering accidentally deleted file folder

2017-10-16 Thread Richard Owlett 
It wasn't backed up - will have to follow advice  advice I've 
given others ;/

I've not done file recovery since early days of WinXP.

On the affected machine I'm running Stretch(9.1) with Mate desktop.
The affected folders are on a partition normally mounted by a 
line in fstab.


I immediately shut down.
There is another instance of Debian on a separate partition.
Logging in as root I edited fstab commenting out the appropriate 
line.


I feel the the data is still valid - there is just no appropriate 
directory entries for the affected folder and its sub-directories.


Guidance please.

TIA

Recovering accidentally deleted file folder

2017-10-16 Thread Richard Owlett 
It wasn't backed up - will have to follow advice  advice I've 
given others ;/

I've not done file recovery since early days of WinXP.

On the affected machine I'm running Stretch(9.1) with Mate desktop.
The affected folders are on a partition normally mounted by a 
line in fstab.


I immediately shut down.
There is another instance of Debian on a separate partition.
Logging in as root I edited fstab commenting out the appropriate 
line.


I feel the the data is still valid - there is just no appropriate 
directory entries for the affected folder and its sub-directories.


Guidance please.

TIA