undelete files
Hi, I have deleted my /tmp directory by mistake. Since the contents were too large, the system was unable to save the deleted data into .trash folder. After that, the system could not come up with this error gdm user doesn't exist..., so I use Live CD to login into the system. I would like to ask if there is anyway to retrieve deleted data? Thanks, D. -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Re: undelete files
Danesh Daroui: I have deleted my /tmp directory by mistake. Generally, that shouldn't be a problem, since no application should expect to find data stored in there after a reboot anyway. Just recreate it and do 'chmod 1777 /tmp' afterwards. I would like to ask if there is anyway to retrieve deleted data? If you didn't store something important in /tmp/ yourself (which you should avoid in the first), you don't need to recover any data. J. -- My medicine shelf is my altar. [Agree] [Disagree] http://www.slowlydownward.com/NODATA/data_enter2.html signature.asc Description: Digital signature
Undelete files
Hi! Today I just deleted a directory by mistake, it went to the trash, so when I draged it back to my personal directory by mistake again I cancelled the process, and now the directory is gone, do you know if there's a way to get it back? Thanks!!! -- Alejandro Aguila Sáinz [EMAIL PROTECTED] PGP KEY: 14D45A26 Fingerprint: 9670 F4A3 0568 42AF DF1A 2429 C1D3 D6A6 14D4 5A26
Re: Undelete files
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 07/08/08 19:45, Alejandro Aguila Sáinz wrote: Hi! Today I just deleted a directory by mistake, it went to the trash, so when I draged it back to my personal directory by mistake again I cancelled the process, and now the directory is gone, do you know if there's a way to get it back? Thanks!!! Did you unmount the device as soon as the incident occurred? - -- Ron Johnson, Jr. Jefferson LA USA Kittens give Morbo gas. In lighter news, the city of New New York is doomed. -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkh0DmgACgkQS9HxQb37XmfESACdEv14fI/puHl9XLk2L/qlDXie GBYAoOoraCSZoG29o1Au3gDHzpQKY/XH =kqed -END PGP SIGNATURE- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: Undelete files [RESOLVED]
Hi, after googling I just found the solution for my problem, actually I also undeleted a lot of pictures that I deleted several months ago, here is the solution (as root): apt-get install foremost After foremost is installed restart your system to the single user mode (Selecting it from GRUB) , because in my case after trying two times in regular mode I got a segment violation error, and send: foremost -t jpg -i /dev/hda -o /home/recovery Then reboot into regular mode and open the lauch application pop-up (alt+f2) and send: gksu nautilus Then just go to /home/recovery and all your deleted JPG files are back, I took like 20 minutes to show all the files because there was 4 GB recovered. This foremost applications it's really cool, you can also recover a lot of files, just check man foremost. Thanks ! On Tue, Jul 8, 2008 at 8:46 PM, Ron Johnson [EMAIL PROTECTED] wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Why do so many people top-post? On 07/08/08 20:15, Alejandro Aguila Sáinz wrote: Yes, and I mounted it to another Debian system and I found the foremost Excellent. Without doing that, you are sunk. application, it's running right now. I don't know the results yet, so if you have another option please let me know. - From Googling for undelete ext3, I found: http://www.xs4all.nl/~carlo17/howto/undelete_ext3.htmlhttp://www.xs4all.nl/%7Ecarlo17/howto/undelete_ext3.html http://code.google.com/p/ext3grep/ On Tue, Jul 8, 2008 at 8:03 PM, Ron Johnson [EMAIL PROTECTED] mailto:[EMAIL PROTECTED] wrote: On 07/08/08 19:45, Alejandro Aguila Sáinz wrote: Hi! Today I just deleted a directory by mistake, it went to the trash, so when I draged it back to my personal directory by mistake again I cancelled the process, and now the directory is gone, do you know if there's a way to get it back? Thanks!!! Did you unmount the device as soon as the incident occurred? - -- Ron Johnson, Jr. Jefferson LA USA Kittens give Morbo gas. In lighter news, the city of New New York is doomed. -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkh0GGAACgkQS9HxQb37XmezuQCfYcgrkfWbG36WGYOHlgWbXjMh v/sAnA3EngGjcK4SjKA6J8YPJIxiB63X =r44V -END PGP SIGNATURE- -- Alejandro Aguila Sáinz [EMAIL PROTECTED] PGP KEY: 14D45A26 Fingerprint: 9670 F4A3 0568 42AF DF1A 2429 C1D3 D6A6 14D4 5A26
Re: undelete from XFS
Roberto C. Sanchez wrote: On Tue, Mar 06, 2007 at 02:56:48AM +0530, Siju George wrote: yes the sad fact is there is no undelete for XFS! - is it so? restoring from backup then :-( Yep. A recent backup is your only hope, unless you want to spend thousands of dollars on a data recovery service, which may or may not recover your data. Regards, (only half-joking): dd if=/dev/partition-with-lost-data | strings | lpr Be ready with lots of paper. Get out scissors and glue. Invite all the puzzle buffs you know over, offer pizza and prizes to whoever finds the data you need. You might want to spend some time working on that command-line before you commit to spending all that money on paper, glue, pizza and whatever. If any of the data you are after was encrypted, or even just zipped, or even in MS-Word format, you might want to give up right away. -- Håkon Alstadheim spamtrap: [EMAIL PROTECTED] -- 1 hit you are out -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
undelete from XFS
Hi, I just rm -rf some stuff from XFS filesystem :-( is there any way to undelete? Thankyou so much kindRegards Siju -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: undelete from XFS
yes the sad fact is there is no undelete for XFS! - is it so? restoring from backup then :-( Thankyou so much :-) --Siju On 3/6/07, Siju George [EMAIL PROTECTED] wrote: Hi, I just rm -rf some stuff from XFS filesystem :-( is there any way to undelete? Thankyou so much kindRegards Siju -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: undelete from XFS
On Tue, Mar 06, 2007 at 02:56:48AM +0530, Siju George wrote: yes the sad fact is there is no undelete for XFS! - is it so? restoring from backup then :-( Yep. A recent backup is your only hope, unless you want to spend thousands of dollars on a data recovery service, which may or may not recover your data. Regards, -Roberto -- Roberto C. Sanchez http://people.connexer.com/~roberto http://www.connexer.com signature.asc Description: Digital signature
Re: How do I undelete a file in GNU/Linux or UNIX?
--- Glen Yu [EMAIL PROTECTED] wrote: Hi everyone, If I accidentally deleted a file in any GNU/Linux or Unix-based OS, is there anyway I can recover those files? Usually, there isn't. On 'BSD hacks' there is a handy shell script that will backup deleted files to a hidden .trash directory. You will find it on Google. -- Ottavio Caruso I will not purchase any computing equipment from manufacturers that recommend Windows Vista or any other Microsoft® products. http://www.pledgebank.com/boycottvista Cheap talk? Check out Yahoo! Messenger's low PC-to-Phone call rates. http://voice.yahoo.com -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: How do I undelete a file in GNU/Linux or UNIX?
Glen Yu wrote: If I accidentally deleted a file in any GNU/Linux or Unix-based OS, is there anyway I can recover those files? The good news is the file can be recovered in exactly the same way as you do in windows: Restore the file from a recent backup. The bad news is you need to have a backup handy. External firewire hard drives of massive capacity are getting inexpensive, and faubackup can handle nightly backups like a champ. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
How do I undelete a file in GNU/Linux or UNIX?
Hi everyone, If I accidentally deleted a file in any GNU/Linux or Unix-based OS, is there anyway I can recover those files? Cheers, -Glen
Re: How do I undelete a file in GNU/Linux or UNIX?
On Wed, Jan 31, 2007 at 01:00:35PM -0400, Glen Yu wrote: Hi everyone, If I accidentally deleted a file in any GNU/Linux or Unix-based OS, is there anyway I can recover those files? This was recently discussed. The answers are: 1) from a recent backup 2) if you are using a non-journaling FS, Google may turn up some info Regards, -Roberto -- Roberto C. Sanchez http://people.connexer.com/~roberto http://www.connexer.com signature.asc Description: Digital signature
Re: How do I undelete a file in GNU/Linux or UNIX?
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 01/31/07 11:00, Glen Yu wrote: Hi everyone, If I accidentally deleted a file in any GNU/Linux or Unix-based OS, is there anyway I can recover those files? If you are using the ext2 filesystem and pulled the plug immediately, there's a slim chance. Otherwise, restore from backup. -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFFwMzaS9HxQb37XmcRAqGoAKDJcrYVwriFRn+BD1+uKuZE5rz2iQCaArCI 6iHzoqzGh2GWildQr6Zg4nk= =0Yyk -END PGP SIGNATURE- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: How do I undelete a file in GNU/Linux or UNIX?
I was hoping there was some way to resolve it without having to contact the admins =P, but I guess there's just no other choice huh? Anyway, thanks for your input. Cheers, -Glen On 1/31/07, Ron Johnson [EMAIL PROTECTED] wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 01/31/07 11:00, Glen Yu wrote: Hi everyone, If I accidentally deleted a file in any GNU/Linux or Unix-based OS, is there anyway I can recover those files? If you are using the ext2 filesystem and pulled the plug immediately, there's a slim chance. Otherwise, restore from backup. -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFFwMzaS9HxQb37XmcRAqGoAKDJcrYVwriFRn+BD1+uKuZE5rz2iQCaArCI 6iHzoqzGh2GWildQr6Zg4nk= =0Yyk -END PGP SIGNATURE- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: undelete
On Tue, 2007-01-23 at 19:00 +, andy wrote: Tony Heal wrote: OK, how about some preventative stuff. If there is not real way to 'undelete' files. How about adding a script named 'rm' that passes the same switches to from the script to /bin/rm but moves the files to tmp before deleting them. Anyone have something like this hanging around their system somewhere? Tony -Original Message- From: Ron Johnson [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 23, 2007 12:34 PM To: debian-user@lists.debian.org Subject: Re: undelete -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 01/23/07 10:37, Tony Heal wrote: Is there a way to recover deleted files? Maybe, if you are using FAT (highly unlikely) or ext2 (also highly unlikely) and you pulled the plug as soon as you noticed what you did. Sadly, the standard answer, though, is, No, you're SOL. -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFFtkcRS9HxQb37XmcRAqhnAKDNyhcPxKrAPAZROeuWy17vcXm8+QCgmawR ll/LxgpYoAHbF685Mc2yXK8= =5K+z -END PGP SIGNATURE- You could always create an alias and make rm interactive by inserting the -i option, hence rm would now become rm -i which would at least make you think twice before actually deleting it? A Or keep a file named -i in very important directories, and when you issue rm * hopefully rm will interpret it as an argument. However, this is not very nice. We are clever enough to use Linux - careless clicking costs files. :) -- Szia: Nyizsa. -- Click to compare rates on health insurance, save big, shop here: http://tags.bluebottle.com/fc/CAaCMPJkqMSVt23XZEnJ2RQJGjgtcv2F/ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
undelete
Is there a way to recover deleted files? Tony
Re: undelete
2007/1/23, Tony Heal [EMAIL PROTECTED]: Is there a way to recover deleted files? Tony Forensic Analysis. There are some tools that could help to recover deleted files, like the coroners toolkit or sleuthkit/autopsy. http://www.honeynet.org is a good place to learn something about it. http://www.sleuthkit.org/ Best regards, Sergio -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: undelete
Is there a way to recover deleted files? Yes. 1) Shut down the computer. 2) Ask a more specific question. -- http://arhuaco.org http://emQbit.com -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: undelete
Tony Heal wrote: Is there a way to recover deleted files? Tony Yes, but as they said, not if you are still using the same computer. Hugo -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: undelete
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 01/23/07 10:37, Tony Heal wrote: Is there a way to recover deleted files? Maybe, if you are using FAT (highly unlikely) or ext2 (also highly unlikely) and you pulled the plug as soon as you noticed what you did. Sadly, the standard answer, though, is, No, you're SOL. -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFFtkcRS9HxQb37XmcRAqhnAKDNyhcPxKrAPAZROeuWy17vcXm8+QCgmawR ll/LxgpYoAHbF685Mc2yXK8= =5K+z -END PGP SIGNATURE- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
RE: undelete
OK, how about some preventative stuff. If there is not real way to 'undelete' files. How about adding a script named 'rm' that passes the same switches to from the script to /bin/rm but moves the files to tmp before deleting them. Anyone have something like this hanging around their system somewhere? Tony -Original Message- From: Ron Johnson [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 23, 2007 12:34 PM To: debian-user@lists.debian.org Subject: Re: undelete -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 01/23/07 10:37, Tony Heal wrote: Is there a way to recover deleted files? Maybe, if you are using FAT (highly unlikely) or ext2 (also highly unlikely) and you pulled the plug as soon as you noticed what you did. Sadly, the standard answer, though, is, No, you're SOL. -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFFtkcRS9HxQb37XmcRAqhnAKDNyhcPxKrAPAZROeuWy17vcXm8+QCgmawR ll/LxgpYoAHbF685Mc2yXK8= =5K+z -END PGP SIGNATURE- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED] -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: undelete
Tony Heal wrote: OK, how about some preventative stuff. If there is not real way to 'undelete' files. How about adding a script named 'rm' that passes the same switches to from the script to /bin/rm but moves the files to tmp before deleting them. Anyone have something like this hanging around their system somewhere? Tony -Original Message- From: Ron Johnson [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 23, 2007 12:34 PM To: debian-user@lists.debian.org Subject: Re: undelete -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 01/23/07 10:37, Tony Heal wrote: Is there a way to recover deleted files? Maybe, if you are using FAT (highly unlikely) or ext2 (also highly unlikely) and you pulled the plug as soon as you noticed what you did. Sadly, the standard answer, though, is, No, you're SOL. -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFFtkcRS9HxQb37XmcRAqhnAKDNyhcPxKrAPAZROeuWy17vcXm8+QCgmawR ll/LxgpYoAHbF685Mc2yXK8= =5K+z -END PGP SIGNATURE- You could always create an alias and make rm interactive by inserting the -i option, hence rm would now become rm -i which would at least make you think twice before actually deleting it? A
RE: undelete
That does not work to well in an automated script, but thanks Tony _ From: andy [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 23, 2007 2:00 PM To: debian-user@lists.debian.org Subject: Re: undelete Tony Heal wrote: OK, how about some preventative stuff. If there is not real way to 'undelete' files. How about adding a script named 'rm' that passes the same switches to from the script to /bin/rm but moves the files to tmp before deleting them. Anyone have something like this hanging around their system somewhere? Tony -Original Message- From: Ron Johnson [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 23, 2007 12:34 PM To: debian-user@lists.debian.org Subject: Re: undelete -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 01/23/07 10:37, Tony Heal wrote: Is there a way to recover deleted files? Maybe, if you are using FAT (highly unlikely) or ext2 (also highly unlikely) and you pulled the plug as soon as you noticed what you did. Sadly, the standard answer, though, is, No, you're SOL. -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFFtkcRS9HxQb37XmcRAqhnAKDNyhcPxKrAPAZROeuWy17vcXm8+QCgmawR ll/LxgpYoAHbF685Mc2yXK8= =5K+z -END PGP SIGNATURE- You could always create an alias and make rm interactive by inserting the -i option, hence rm would now become rm -i which would at least make you think twice before actually deleting it? A
RE: undelete
On Tue, 2007-01-23 at 13:44 -0500, Tony Heal wrote: OK, how about some preventative stuff. If there is not real way to 'undelete' files. How about adding a script named 'rm' that passes the same switches to from the script to /bin/rm but moves the files to tmp before deleting them. Anyone have something like this hanging around their system somewhere? I think you want libtrash, from the description: libtrash is a shared library which, when preloaded, implements a trash can under GNU/Linux. This way, your mistakes (at least those of the rm -rf dir / class :-)) will no longer cause the loss of a week's work or your system's binaries. However, I believe it broke some stuff or misbehaved in other ways. I can't remember exactly but Google can probably dig up som criticisms. -- Cheers, Sven Arvidsson http://www.whiz.se PGP Key ID 760BDD22 signature.asc Description: This is a digitally signed message part
Re: undelete
On Tue, Jan 23, 2007 at 11:37:51AM -0500, Tony Heal wrote: Is there a way to recover deleted files? Yes. From a recent backup. Regards, -Roberto -- Roberto C. Sanchez http://people.connexer.com/~roberto http://www.connexer.com signature.asc Description: Digital signature
Re: undelete
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 You could probably write a perl or python script (call it safe_rm) that traps the input parameters and does a fancy mv, echoing the fully qualified file name into either ~/.trash (if run by an unprivileged user, or /trash if by root. Sadly, this will only save files that you delete from the CLI. To be universal, such a trash feature would have to be implemented either in the OS (a highly unlikely prospect) or within the libc ulink() function. (Also highly unlikely, but much more portable than changing every OS that libc runs on.) On 01/23/07 12:44, Tony Heal wrote: OK, how about some preventative stuff. If there is not real way to 'undelete' files. How about adding a script named 'rm' that passes the same switches to from the script to /bin/rm but moves the files to tmp before deleting them. Anyone have something like this hanging around their system somewhere? Tony -Original Message- From: Ron Johnson [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 23, 2007 12:34 PM To: debian-user@lists.debian.org Subject: Re: undelete On 01/23/07 10:37, Tony Heal wrote: Is there a way to recover deleted files? Maybe, if you are using FAT (highly unlikely) or ext2 (also highly unlikely) and you pulled the plug as soon as you noticed what you did. Sadly, the standard answer, though, is, No, you're SOL. -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFFtmH5S9HxQb37XmcRArgjAJ9j32V43WpcgQRy8/L/lu3RdaAjbACfWtW5 RCP8vph0/rrqE9RgUkD1PFY= =l8Q0 -END PGP SIGNATURE- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: undelete
On Tue, Jan 23, 2007 at 02:06:02PM -0500, Tony Heal wrote: That does not work to well in an automated script, but thanks what doesn't? oh, top-posting. please don't do that. Tony Heal wrote: OK, how about some preventative stuff. If there is not real way to 'undelete' files. How about adding a script named 'rm' that passes the same switches to from the script to /bin/rm but moves the files to tmp before deleting them. I don't have one, but it would be trivial to write a bash script that takes an rm arglist target and turns it into a mv target /tmp/trash. simply alias rm to that script in bashrc et al. or, if you wanted system-wide Trashing you could mv the rm binary out of the way and symlink to your script. the implications of that could be huge though. A -Original Message- From: Ron Johnson [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 23, 2007 12:34 PM To: debian-user@lists.debian.org Subject: Re: undelete On 01/23/07 10:37, Tony Heal wrote: Is there a way to recover deleted files? Maybe, if you are using FAT (highly unlikely) or ext2 (also highly unlikely) and you pulled the plug as soon as you noticed what you did. Sadly, the standard answer, though, is, No, you're SOL. You could always create an alias and make rm interactive by inserting the -i option, hence rm would now become rm -i which would at least make you think twice before actually deleting it? A signature.asc Description: Digital signature
Re: undelete
On Tue, Jan 23, 2007 at 11:32:31AM -0800, Andrew Sackville-West wrote: On Tue, Jan 23, 2007 at 02:06:02PM -0500, Tony Heal wrote: OK, how about some preventative stuff. If there is not real way to 'undelete' files. How about adding a script named 'rm' that passes the same switches to from the script to /bin/rm but moves the files to tmp before deleting them. I don't have one, but it would be trivial to write a bash script that takes an rm arglist target and turns it into a mv target /tmp/trash. simply alias rm to that script in bashrc et al. or, if you wanted system-wide Trashing you could mv the rm binary out of the way and symlink to your script. the implications of that could be huge though. Something like this *might* work, but is off-the-cuff, not tested: $ cat ~/bin/rm2trash #!/bin/sh TRASH=~/.trash for f in $*; do echo TEST of $0: echo cp -pf $f $TRASH/$f echo rm $f done ... make it executable, alias the rm command to run it, e.g., $ chmod +x ~/bin/rm2trash $ alias rm=rm2trash and *maybe* it would work. Remove the 'echo' commands if the output looks ok. (Note that it would be best to store options from the command line to pass along to the inner rm, along with other niceties.) A real danger in using this sort of crutch is that you'll get nailed if you rely on it, assume it's there, and then end up using the native rm without knowing it. The same goes for alias rm='rm -i'. IMHO the best approach is to realize the nature of the system you're working with, learn to use the native commands, and set up a decent backup system. For backups, I use and would recommend the rsnapshot package, which uses rsync to efficiently create copies of filesystems. This might normally be done to a networked backup server, but can also run on a single machine. Lots of other schemes are available, using rsync and otherwise. Ken -- Ken Irving, [EMAIL PROTECTED] -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: undelete
On Tue, Jan 23, 2007 at 11:25:21AM -0900, Ken Irving wrote: On Tue, Jan 23, 2007 at 11:32:31AM -0800, Andrew Sackville-West wrote: On Tue, Jan 23, 2007 at 02:06:02PM -0500, Tony Heal wrote: OK, how about some preventative stuff. If there is not real way to 'undelete' files. How about adding a script named 'rm' that passes the same switches to from the script to /bin/rm but moves the files to tmp before deleting them. I don't have one, but it would be trivial to write a bash script that takes an rm arglist target and turns it into a mv target /tmp/trash. simply alias rm to that script in bashrc et al. or, if you wanted system-wide Trashing you could mv the rm binary out of the way and symlink to your script. the implications of that could be huge though. Something like this *might* work, but is off-the-cuff, not tested: $ cat ~/bin/rm2trash #!/bin/sh TRASH=~/.trash for f in $*; do echo TEST of $0: echo cp -pf $f $TRASH/$f echo rm $f done ... make it executable, alias the rm command to run it, e.g., $ chmod +x ~/bin/rm2trash $ alias rm=rm2trash sorta works but bombs if .trash doesn't exist, or if rm switches are used (eg. -rf). hows this [EMAIL PROTECTED]:~$ cat rm2trash #!/bin/bash TRASH=~/.trash if [ ! -e $TRASH ]; then mkdir $TRASH fi for f in $*; do if [ -e $f ]; then cp -pf $f $TRASH/$f rm $f else echo $f does not exist, skipping. fi done A real danger in using this sort of crutch is that you'll get nailed if you rely on it, assume it's there, and then end up using the native rm without knowing it. The same goes for alias rm='rm -i'. IMHO the best approach is to realize the nature of the system you're working with, learn to use the native commands, and set up a decent backup system. you are correct sir! A signature.asc Description: Digital signature
Re: undelete
Andrew Sackville-West wrote:
On Tue, Jan 23, 2007 at 11:25:21AM -0900, Ken Irving wrote:
On Tue, Jan 23, 2007 at 11:32:31AM -0800, Andrew Sackville-West wrote:
On Tue, Jan 23, 2007 at 02:06:02PM -0500, Tony Heal wrote:
OK, how about some preventative stuff. If there is not real way to
'undelete' files. How about adding a script named 'rm' that passes the same
switches to from the script to /bin/rm but moves the files to tmp before
deleting them.
I don't have one, but it would be trivial to write a bash script that
takes an rm arglist target and turns it into a mv target
/tmp/trash. simply alias rm to that script in bashrc et al. or, if you
wanted system-wide Trashing you could mv the rm binary out of the
way and symlink to your script. the implications of that could be huge
though.
Something like this *might* work, but is off-the-cuff, not tested:
[snip]
sorta works but bombs if .trash doesn't exist, or if rm switches are
used (eg. -rf). hows this
[snip]
A real danger in using this sort of crutch is that you'll get nailed if
you rely on it, assume it's there, and then end up using the native rm
without knowing it. The same goes for alias rm='rm -i'.
IMHO the best approach is to realize the nature of the system you're
working with, learn to use the native commands, and set up a decent
backup system.
Another approach is that mentioned in
http://www.mikerubel.org/computers/rsync_snapshots/
Look for Extensions: hourly, daily, and weekly snapshots
One can create a directory ~/.snapshot with subdirectories
like hourly.1, hourly.2, daily, monthly, etc.
If you delete a file, then a copy which is at most one hour
old will be in ~/.snapshot/hourly.1
The technique described does not eat enormous amounts of disc,
either.
Mike
--
p=p=%c%s%c;main(){printf(p,34,p,34);};main(){printf(p,34,p,34);}
This message made from 100% recycled bits.
You have found the bank of Larn.
I can explain it for you, but I can't understand it for you.
I speak only for myself, and I am unanimous in that!
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: RE: undelete
Tony Heal wrote: OK, how about some preventative stuff. If there is not real way to 'undelete' files. How about adding a script named 'rm' that passes the same switches to from the script to /bin/rm but moves the files to tmp before deleting them. Anyone have something like this hanging around their system somewhere? How about making sure you have a directory called ~/.Trash and then making a script like... #!/bin/bash mv $@ ~/.Trash exit 0 And then... put this in ~/bin/rm And then alias rm=~/bin/rm to make sure you use that one (Or make sure ~/bin is first in your path, or just call /home/user/bin/rm explicitly.) Angelo -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: RE: undelete
On Tue, Jan 23, 2007 at 04:46:17PM -0500, Angelo Bertolli wrote: #!/bin/bash mv $@ ~/.Trash Hmm. There are some problems here: [EMAIL PROTECTED]:~$ which rm /home/roberto/bin/rm [EMAIL PROTECTED]:~$ touch test [EMAIL PROTECTED]:~$ rm test [EMAIL PROTECTED]:~$ ls .Trash/ test [EMAIL PROTECTED]:~$ touch test [EMAIL PROTECTED]:~$ rm test mv: overwrite `/home/roberto/.Trash/test'? y [EMAIL PROTECTED]:~$ touch test [EMAIL PROTECTED]:~$ rm -f test [EMAIL PROTECTED]:~$ ls .Trash/ test [EMAIL PROTECTED]:~$ mkdir testdir [EMAIL PROTECTED]:~$ touch testdir/test [EMAIL PROTECTED]:~$ rm -r testdir/ mv: invalid option -- r Try `mv --help' for more information. [EMAIL PROTECTED]:~$ touch test2 [EMAIL PROTECTED]:~$ rm -- test2 [EMAIL PROTECTED]:~$ ls .Trash/ test test2 I'd say it needs some more smarts. exit 0 This is universally bad. You are declaring here that no matter the exit code of the mv command, this script will exit successfully. You should generally exit with something like $? to make sure that the exit code gets passed to the calling shell. Regards, -Roberto -- Roberto C. Sanchez http://people.connexer.com/~roberto http://www.connexer.com signature.asc Description: Digital signature
Re: undelete
Tony Heal wrote: Is there a way to recover deleted files? Restore it from your backup media. Failing that, it's gone (think twice, delete once). Better get yourself a nice firewire external hard drive of incredible size and start using faubackup before it happens again. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: undelete
On Tue, Jan 23, 2007 at 01:44:17PM -0500, Tony Heal wrote: OK, how about some preventative stuff. If there is not real way to 'undelete' files. How about adding a script named 'rm' that passes the same switches to from the script to /bin/rm but moves the files to tmp before deleting them. I prefer to have working and tested backups. -- http://bitfolk.com/ -- No-nonsense VPS hosting Encrypted mail welcome - keyid 0x604DE5DB signature.asc Description: Digital signature
Re: UNdelete ???
Raquel wrote:
I have a server that I totally messed up because I did something
really stupid. It was back up and running within about 4 hours.
Since then I've been working on backing up more and better/smarter.
You might consider something like this for the future...
http://www.mikerubel.org/computers/rsync_snapshots/
Mike
--
p=p=%c%s%c;main(){printf(p,34,p,34);};main(){printf(p,34,p,34);}
This message made from 100% recycled bits.
You have found the bank of Larn.
I can explain it for you, but I can't understand it for you.
I speak only for myself, and I am unanimous in that!
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: UNdelete ???
Hi! Which filesystem? For ext2 there are same tool for recovery delete data, also for reiser (but here i'm not sure). But for ext3. :-(
Re: UNdelete ???
Which filesystem? I am using ext3. I do not understand why this matters. How a filesystem manages its unallocated space is up to it - there is no specification for this. This is one reason people say you do not need to defragment ext2/3 filesystems - because they are clever about how they lay out the disk. When you delete a file, the space it occupied becomes unallocated, available for reallocation to other files as needed. To undelete a file, you need to know the internals of the filesystem structure to recover the contents - if it is still available at all. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
EXT3 Undelete
Selam, Kullanıcılar tarafından yanlışla silinen dosyları geri almanın yolu varmıdır(ext3). Yada 3 ncu bir yazılımla boyle bir şeyi gerçekleştirebilirmiyiz. Sistem: Debian 3.1 (Sarge) -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: Best file system for Disk quotas and undelete
On 5/6/05, Lee Braiden [EMAIL PROTECTED] wrote: On Friday 06 May 2005 10:33, Siju George wrote: ext2? ext3? ReiserFS? JFS? Personally, I prefer XFS. ReiserFS is a good choice too, but I still have stability concerns regarding Reiser. one more quick question please :-) if I run the Debian on XFS and if the system reboots suddenly due to a power outage ( we have UPS but it cannot handle certain kind of fluctuation. we will be having another one soon) will the file system recover automatically as in the case of ext3 while the system boots up again?? Thankyou kind regards Siju
Re: Best file system for Disk quotas and undelete
Dear Lee, sorry for the late reply :-( there was no office for two days. On 5/6/05, Lee Braiden [EMAIL PROTECTED] wrote: On Friday 06 May 2005 12:15, Siju George wrote: actually I don't run a GUI on this machine because it is a server that hosts some PHP website development. Ahh. What are you actually trying to prevent, then? Accidentally deleting your web projects? not at all haha!!! just wanted to have an option in case something happens For software projects, I'd recommend getting used to a version control system like Subversion. Although not intended for it, version control gives you a backup of your most recent working copy, along with a timeline of backups covering the entire evolution of your project. Apart from that, it'll make lots of other software development issues easier :) If you go a little further, and backup the version control's repository directory, you gain not only a two-level backup system, but a backup of everything you've ever done on a project :) Yes I'll soon implement subversion on the server :-) Thanks a lot Lee for introducing Faubackup. I am going to try it. I heard of another software called Bacula. How do you compare both?? which is better?? I haven't tried bacula personally. I suspect it's more oriented towards larger installations of workstations and a central backup server, but I may be wrong. There are a number of backup options, which will mainly depend on the scale of your backup needs, how seriously you take the backups, and your willingness to be involved in the backup processes themselves. If you have multiple Debian (or Unix) machines on a secure LAN, the quickest way of achieving a real backup solution is probably to use faubackup to automatically backup everything to another box. Presently I am using Ext3 is XFS better than Ext3?? I'm no expert, but from what I've read of others' opinions, I would say so, yes. Ext3 is essentially a hack of Ext2 to gain journalling, whereas XFS has a long and successful history in a high-end unix operating system, with journalling from the beginning, afaik. To me, it's just a more professional filesystem. Ext3 gets a lot of good press for exactly that: being a small change to Ext2. Basically, it's a simple way to get journalling if you've already setup ext2, rather than a good long-term solution, imho. There are a few arguments for the reliability of ext3 (since it can use tested ext2 tools, etc.), but I think it's safe to say that XFS is more mature than ext3. Ext3 is pretty slow as well, I think. Again though, it's a matter of personal choice. Reiser does have some interesting qualities too: notably speed on small files and large directories. There are a few comparisons and benchmarks etc. available online, if you want to research your choice further. On the other hand, if you have Ext3 now, and it works, and your projects are on that filesystem... well, if it ain't broke... ;) Will I be able to get the option to install XFS while installing from the Woody 3.0r5 CD? Or should I do something else to get XFS??? Sarge is almost at the point of being the new Woody, and therefore probably a better choice than Woody. I'm not sure if it supports XFS out of the box, but if not, you should be able to find Sarge XFS installation images, which will set you up with XFS during install, as you're hoping. all right Lee, thanks a lot god luck :-) kind regards Siju
Best file system for Disk quotas and undelete
Hi all, May I know which filesystem is best for Debian woody 3.0r5 for 1) implementing and managing disk quotas 2) easy undeleting of files ext2? ext3? ReiserFS? JFS? Thankyou so much kind regards Siju
Re: Best file system for Disk quotas and undelete
On Friday 06 May 2005 10:33, Siju George wrote: 1) implementing and managing disk quotas I think most of the mainstream filesystems support this equally well. Not sure though. 2) easy undeleting of files Undeleting files shouldn't be part of a strategy. At best, it's a last resort. If it actually works, it's a *lucky* last resort. A combination of backing up your important files (always a good idea), setting rm to be interactive, and/or using the recycle bin/trashcan on your desktop instead of a permanent deletion would be a much better way to go. Faubackup is pretty easy, if you want a *very* low maintenance backup solution. Basically, you just edit it's config file for how many snapshots you want to keep as backups (the last week, or the last three weeks, or every month in the last year, etc.), and then edit the cron script for which directories to backup. You'll then get a backup directory that keeps files from those times. If you delete a file, just go to the backup directory, and retrieve yesterday's copy. If you need copies from the last five-to-thirty minutes, and it's a text file, that's what editor backup files are usually for. Most of all though: be careful! :D ext2? ext3? ReiserFS? JFS? Personally, I prefer XFS. ReiserFS is a good choice too, but I still have stability concerns regarding Reiser. -- Lee. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: Best file system for Disk quotas and undelete
Thankyou so much Lee for your detailed reply. I appreciate them very much :-) On 5/6/05, Lee Braiden [EMAIL PROTECTED] wrote: On Friday 06 May 2005 10:33, Siju George wrote: Undeleting files shouldn't be part of a strategy. At best, it's a last resort. If it actually works, it's a *lucky* last resort. A combination of backing up your important files (always a good idea), setting rm to be interactive, and/or using the recycle bin/trashcan on your desktop instead of a permanent deletion would be a much better way to go. actually I don't run a GUI on this machine because it is a server that hosts some PHP website development. Faubackup is pretty easy, if you want a *very* low maintenance backup solution. Basically, you just edit it's config file for how many snapshots you want to keep as backups (the last week, or the last three weeks, or every month in the last year, etc.), and then edit the cron script for which directories to backup. You'll then get a backup directory that keeps files from those times. If you delete a file, just go to the backup directory, and retrieve yesterday's copy. Thanks a lot Lee for introducing Faubackup. I am going to try it. I heard of another software called Bacula. How do you compare both?? which is better?? Most of all though: be careful! :D yes :-) ext2? ext3? ReiserFS? JFS? Personally, I prefer XFS. ReiserFS is a good choice too, but I still have stability concerns regarding Reiser. Presently I am using Ext3 is XFS better than Ext3?? Will I be able to get the option to install XFS while installing from the Woody 3.0r5 CD? Or should I do something else to get XFS??? Thanks a lot once again for your reply :-) kind regards Siju
Re: Best file system for Disk quotas and undelete
On Friday 06 May 2005 12:15, Siju George wrote: actually I don't run a GUI on this machine because it is a server that hosts some PHP website development. Ahh. What are you actually trying to prevent, then? Accidentally deleting your web projects? For software projects, I'd recommend getting used to a version control system like Subversion. Although not intended for it, version control gives you a backup of your most recent working copy, along with a timeline of backups covering the entire evolution of your project. Apart from that, it'll make lots of other software development issues easier :) If you go a little further, and backup the version control's repository directory, you gain not only a two-level backup system, but a backup of everything you've ever done on a project :) Thanks a lot Lee for introducing Faubackup. I am going to try it. I heard of another software called Bacula. How do you compare both?? which is better?? I haven't tried bacula personally. I suspect it's more oriented towards larger installations of workstations and a central backup server, but I may be wrong. There are a number of backup options, which will mainly depend on the scale of your backup needs, how seriously you take the backups, and your willingness to be involved in the backup processes themselves. If you have multiple Debian (or Unix) machines on a secure LAN, the quickest way of achieving a real backup solution is probably to use faubackup to automatically backup everything to another box. Presently I am using Ext3 is XFS better than Ext3?? I'm no expert, but from what I've read of others' opinions, I would say so, yes. Ext3 is essentially a hack of Ext2 to gain journalling, whereas XFS has a long and successful history in a high-end unix operating system, with journalling from the beginning, afaik. To me, it's just a more professional filesystem. Ext3 gets a lot of good press for exactly that: being a small change to Ext2. Basically, it's a simple way to get journalling if you've already setup ext2, rather than a good long-term solution, imho. There are a few arguments for the reliability of ext3 (since it can use tested ext2 tools, etc.), but I think it's safe to say that XFS is more mature than ext3. Ext3 is pretty slow as well, I think. Again though, it's a matter of personal choice. Reiser does have some interesting qualities too: notably speed on small files and large directories. There are a few comparisons and benchmarks etc. available online, if you want to research your choice further. On the other hand, if you have Ext3 now, and it works, and your projects are on that filesystem... well, if it ain't broke... ;) Will I be able to get the option to install XFS while installing from the Woody 3.0r5 CD? Or should I do something else to get XFS??? Sarge is almost at the point of being the new Woody, and therefore probably a better choice than Woody. I'm not sure if it supports XFS out of the box, but if not, you should be able to find Sarge XFS installation images, which will set you up with XFS during install, as you're hoping. Thanks a lot once again for your reply :-) Glad to be of help :) -- Lee. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: ext3 undelete/recovery
Alvin Oga aoga at ns.Linux-Consulting.com writes: On Fri, 7 Jan 2005, Alban Browaeys wrote: I just wanted this to be somewhere , seems it s not worst a place than any other. With ext3 you cannot undelete a file . out of curiousity, which undelete tools did you use ?? underneath ext3 is an ext2 fs ... so i dumb/unexperienced commentary is that i should be able to undelete ext2 files ( esp if i turned off ext3 to do the undeleting ? ) That s right. But only if it was delete in a proper way, for example with rm . Undelete tools : recover, debugfs : http://www.praeclarus.demon.co.uk/tech/e2-undel/html/howto-8.html mc: http://www.stearns.org/doc/file-recovery.v0.81.html When you rm a file, ext3 take extra steps that prevents those tools from finding deleted data. There is still a way to undelete, grep the filesystem/partition : grep /dev/hda1 for example, but that s a no go for most people. http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html Q: How can I recover (undelete) deleted files from my ext3 partition? In order to ensure that ext3 can safely resume an unlink after a crash, it actually zeros out the block pointers in the inode, whereas ext2 just marks these blocks as unused in the block bitmaps and marks the inode as deleted and leaves the block pointers alone. Your only hope is to grep for parts of your files that have been deleted and hope for the best. Alban -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: ext3 undelete/recovery
hi ya alban On Fri, 7 Jan 2005, Alban Browaeys wrote: i assume the comment below is the rm command That s right. But only if it was delete in a proper way, for example with rm . .. When you rm a file, ext3 take extra steps that prevents those tools from finding deleted data. There is still a way to undelete, grep the filesystem/partition : grep /dev/hda1 for example, but that s a no go for most people. as long as the data is intact, one could stitch the inode links back together again ( with debugfs ? ) or any other tools http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html Q: How can I recover (undelete) deleted files from my ext3 partition? In order to ensure that ext3 can safely resume an unlink after a crash, it actually zeros out the block pointers in the inode, which is okay if it left the (ascii) file contents intact and one really wanted to undelet, it might still be possible in some cases .. thanx for the info... have fun alvin -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
ext3 undelete/recovery
I just wanted this to be somewhere , seems it s not worst a place than any other. With ext3 you cannot undelete a file . That s right. But only if it was delete in a proper way, for example with rm . In case of a power failure, at reboot if the filesystem is badly broken and some file are lost during the filesystem recovery (fsck), before mounting the partition one can undelete the file deleted by fsck with the usual ext2 undelete tools. PS: Ext3 as it syncs data and metadata to disk every two seconds, thus benign powerfailure does not hurt it badly. That explains why its slower than other journalized fs which by default only sync metadata at this rate. Ciao Alban -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: ext3 undelete/recovery
On Fri, 7 Jan 2005, Alban Browaeys wrote:
I just wanted this to be somewhere , seems it s not worst a place than any
other.
With ext3 you cannot undelete a file .
out of curiousity, which undelete tools did you use ??
underneath ext3 is an ext2 fs ... so i dumb/unexperienced commentary is
that i should be able to undelete ext2 files ( esp if i turned off ext3 to
do the undeleting ? )
That s right. But only if it was delete
in a proper way, for example with rm .
a common way to have an oopsie
cp /dev/null ooppps.txt is another common [EMAIL PROTECTED]
perl { ... unlink $SomeDirectory/$someFile.doc ; } ..
- more undelete tools
http://Linux-Sec.net/Txt/undelete.txt ( bottom of the list )
c ya
alvin
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Undelete von Dateien (was: Habe_/var/lib/dpkg/status_gelscht!_Wie_k rieg_ich_die_wieder_her?!)
Ulrich Fürst [EMAIL PROTECTED] schrieb: Danke, wollte nicht googeln oder überhaupt möglichst wenig machen, falls es sowas wie undelet gibt. Gibt es, z.B. recover. Allerdings würde ich mir auf der /var-Partition nicht viel Hoffnung machen. Für dich dürfte es Lösung 3 werden. Wenn das downloaden auf von der CD holen rausläuft, hast du Glück... Ich hab sogar noch mehr Glück. Die 1. Lösung gefällt mir. Die nehm ich! Dann kann's ja Weihnachten werden. Gruß, Frank -- Frank Küster, Biozentrum der Univ. Basel Abt. Biophysikalische Chemie -- Haeufig gestellte Fragen und Antworten (FAQ): http://www.de.debian.org/debian-user-german-FAQ/ Zum AUSTRAGEN schicken Sie eine Mail an [EMAIL PROTECTED] mit dem Subject unsubscribe. Probleme? Mail an [EMAIL PROTECTED] (engl)
undelete
I have foolishly deleted a file I did not want to. It was created this morning, so it is not backed up. is there an undelete util ? thanks Matt -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
RE: undelete
I have tried 'recover' Package: recover Priority: optional Section: admin Installed-Size: 104 Maintainer: Noel Koethe [EMAIL PROTECTED] Architecture: i386 Version: 1.3b-1 Depends: libc6 (= 2.2.4-4) Filename: pool/main/r/recover/recover_1.3b-1_i386.deb Size: 13360 MD5sum: a6d0b77ce1ad858878f46b426490a661 Description: Undelete files on ext2 partitions Recover automates some steps as described in the ext2-undeletion howto. This means it seeks all the deleted inodes on your hard drive with debugfs. When all the inodes are indexed, recover asks you some questions about the deleted file. These questions are: * Hard disk device name * Year of deletion * Month of deletion * Weekday of deletion * First/Last possible day of month * Min/Max possible file size * Min/Max possible deletion hour * Min/Max possible deletion minute * User ID of the deleted file * A text string the file included (can be ignored) . If recover found any fitting inodes, it asks to give a directory name and dumps the inodes into the directory. Finally it asks you if you want to filter the inodes again (in case you typed some wrong answers). but I get a segmentaion error. Matt -- -Original Message- From: Joyce, Matthew Sent: Monday, 31 March 2003 12:00 PM To: [EMAIL PROTECTED] Subject: undelete I have foolishly deleted a file I did not want to. It was created this morning, so it is not backed up. is there an undelete util ? thanks Matt -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED] -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: undelete
On Mon, 31 Mar 2003 11:40:33 +1000 Joyce, Matthew [EMAIL PROTECTED] wrote: I have foolishly deleted a file I did not want to. It was created this morning, so it is not backed up. is there an undelete util ? recover undeletes files on ext2 partitions. If you have an ext3 partition, unmount it and remount as ext2. I don't know about undelete utilities for other filesystems. Kevin -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: undelete
On Mon, Mar 31, 2003 at 11:40:33AM +1000, Joyce, Matthew wrote: I have foolishly deleted a file I did not want to. It was created this morning, so it is not backed up. is there an undelete util ? $ apt-cache search undelete e2undel - Undelete utility for the ext2 file system endeavour2 - File manager with builtin file previewer gtkrecover - GUI for recover recover - Undelete files on ext2 partitions gmc - Midnight Commander - A powerful file manager. - Gnome version $ -- Seneca [EMAIL PROTECTED] pgp0.pgp Description: PGP signature
Re: undelete
I have foolishly deleted a file I did not want to. It was created this morning, so it is not backed up. is there an undelete util ? thanks Matt Matt, There is not an undelete utility as you might find under a proprietary operating system. However, if you were editing that file, in Emacs for example, there may have been an automatic back-up made. Emacs does this to whatever file you are editing, (unless you tell it not to,) and creates a file of the same name that you were editing. It names it file~ (file with a tilde.) Other editors do this as well I believe. The file is not gone even if you deleted it, it has just been unlinked. This means the bits of the file are still in the file system, you just have destroyed the pointer to it. It is now non-trivial to retrieve it unfortunately. If you used the command shred to delete the file it has been overwritten and even the FBI should be unable to retrieve it. There are ways to get the file back, but they often require advanced knowledge and sometimes money to buy data-recovery services or software. Cheers, Jeremiah -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: undelete
On Mon, 31 Mar 2003 11:40:33 +1000 Joyce, Matthew [EMAIL PROTECTED] wrote: I have foolishly deleted a file I did not want to. It was created this morning, so it is not backed up. is there an undelete util ? Although it's too late to help you recover the data you've already deleted, you (and most users) would be wise to download and install Libtrash. It's a Linux trashcan, and unlike the ones in KDE and Gnome, it works everywhere, even from the console. You can find it here: http://www.m-arriaga.net/software/libtrash/libtrash-latest.tgz regards, Robert -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: undelete
On Mon, Mar 31, 2003 at 12:06:06AM -0500, Jeremiah Foster wrote: I have foolishly deleted a file I did not want to. It was created this morning, so it is not backed up. is there an undelete util ? i've definitely been in these shoes before. it may be too late depending on how active your filesystem is. here's what i'd try, fingers crossed. a - unmount the filesystem!!! if it's at all possible, unmount it, stop writing to it! you can also remount it read-only if you must. if you can't do that (like if it's in /var or something), boot up from a floppy disk or knoppix cd or something. once you're able to do this, you can take a deep breath, because if it's safe, it will now stay safe, and if it's not, then it's already gone and you can't do anything about it. b - read up on documentation for debugfs. when you delete a file, it's contents aren't actually deleted (that'd be a waste of cpu and disk access), instead, the inodes for your files are simply returned to a pool of deleted inodes, which may at some point be used again for another file (after which, you're basically SOL if you don't have 5 digits to spend and a professional cpu forensics lab) if you're lucky though, these inodes have remained undisturbed, and you can get them back with debugfs. i won't go into the details of the program, but it comes with some good documentation and googling should fill in the rest of the blanks. you should be able to use it to get a list of deleted inodes, which you can then dump to another filesystem, which you can then grep for your precious data. good luck... sean pgp0.pgp Description: PGP signature
Undelete para Ext3 - URGENTE
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Buenas! ¿Alguien me puede decir si es posible recuperar ficheros borrados en una particion ext3??? - -- Un saludo, Jaime Robles [EMAIL PROTECTED] Coordinador KDE-es - KDE Spanish Translation Team http://www.kde.org/es - http://es.i18n.kde.org -BEGIN PGP SIGNATURE- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE+Xff3ER46oL+8yYURAhVnAJ9mhTzzHT/IbZXcuzfW8CTNMqE1UACfZKFV hj/Hh/3ftzpXQ4RPaZcwEws= =sWTc -END PGP SIGNATURE-
Re: Undelete para Ext3 - URGENTE
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Debería servirte recover, ext3 está implementado sobre ext2 :))) Un saludo Victor On Thursday 27 February 2003 12:35, Jaime Robles wrote: Buenas! ¿Alguien me puede decir si es posible recuperar ficheros borrados en una particion ext3??? -BEGIN PGP SIGNATURE- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE+XgMVEzqHF8R72ekRAtrCAJ9auejC7q++W5hr9QESSsA83ikCmgCeJJhh OAnqs97MJI46cw+p16/fPz0= =ICJv -END PGP SIGNATURE-
Re: Undelete para Ext3 - URGENTE
Aupa Victor! El Thu, 27 Feb 2003 13:22:45 +0100 Victor Calzado Mayo [EMAIL PROTECTED] comentaba: ¿Alguien me puede decir si es posible recuperar ficheros borrados en una particion ext3??? Debería servirte recover, ext3 está implementado sobre ext2 que va, por lo que he leído, recover y el resto de utilidades para ext2, fallan en ext3, porque la gestión de disco es algo diferente. A mi el debugfs siempre me ha dado problemas en ext3. -- Agur txipi wget -O - http://sindominio.net/~txipi/txipi.gpg.asc | gpg --import Key fingerprint = CCAF 9676 B049 997A 96D6 4D7C 3529 5545 4375 1BF4
Re: Undelete para Ext3 - URGENTE
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 El Jueves, 27 de Febrero de 2003 14:56, txipi escribió: ¿Alguien me puede decir si es posible recuperar ficheros borrados en una particion ext3??? Debería servirte recover, ext3 está implementado sobre ext2 que va, por lo que he leído, recover y el resto de utilidades para ext2, 1000 gracias a ambos... al final lo que me ha sacado del apuro es el backup ;-) - -- Un saludo, Jaime Robles [EMAIL PROTECTED] Coordinador KDE-es - KDE Spanish Translation Team http://www.kde.org/es - http://es.i18n.kde.org -BEGIN PGP SIGNATURE- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE+XjGOER46oL+8yYURAhaNAJwJxv/dLPk7rhNOoUpsiMMWxQZHggCeL4MA E1XDvdWHgSTm+w5Hgdw81xg= =BDed -END PGP SIGNATURE-
Re: Undelete para Ext3 - URGENTE
Victor Calzado Mayo, [EMAIL PROTECTED]:22:45(+0100): Debería servirte recover, ext3 está implementado sobre ext2 :))) Pues a mí una vez casi me tumba la máquina porque se puso a chupar RAM y claro, como se ejecutaba como root... Lo he intentado más veces, incluso con una partición pequeña como /tmp y me ha pasado lo mismo. Uso el recover de stable, por si sirve de algo. -- David Serrano [EMAIL PROTECTED] - Linux Registered User #87069
undelete
hi, habe versehentlich im midnight commander dateien über f8 gelöscht! Gibt es eine Möglichkeit die wiederherzustellen ? abe ext3 als Dateisystem! Gruß, Thomas -- Haeufig gestellte Fragen und Antworten (FAQ): http://www.de.debian.org/debian-user-german-FAQ/ Zum AUSTRAGEN schicken Sie eine Mail an [EMAIL PROTECTED] mit dem Subject unsubscribe. Probleme? Mail an [EMAIL PROTECTED] (engl)
Re: undelete
* Thomas Schröter [EMAIL PROTECTED] wrote: habe versehentlich im midnight commander dateien über f8 gelöscht! Gibt es eine Möglichkeit die wiederherzustellen ? Was genau an http://www.google.com/search?q=linux+undelete ist so schwer zu begreifen? -- Haeufig gestellte Fragen und Antworten (FAQ): http://www.de.debian.org/debian-user-german-FAQ/ Zum AUSTRAGEN schicken Sie eine Mail an [EMAIL PROTECTED] mit dem Subject unsubscribe. Probleme? Mail an [EMAIL PROTECTED] (engl)
Re: undelete
Hi, 0n 03/02/15@16:54 Thomas Schröter told me: habe versehentlich im midnight commander dateien über f8 gelöscht! Gibt es eine Möglichkeit die wiederherzustellen ? abe ext3 als Dateisystem! Sofort unmounten und es gibt ein Undelete HOWTO fuer ext2, dass muesste AFAIK auch bei ext3 helfen. Da es auch ein backup-HOWTO gibt, habe ich es aber noch nicht gebraucht. -- bye maik -- Haeufig gestellte Fragen und Antworten (FAQ): http://www.de.debian.org/debian-user-german-FAQ/ Zum AUSTRAGEN schicken Sie eine Mail an [EMAIL PROTECTED] mit dem Subject unsubscribe. Probleme? Mail an [EMAIL PROTECTED] (engl)
Re: undelete
Thomas Schröter schrieb: habe versehentlich im midnight commander dateien über f8 gelöscht! Gibt es eine Möglichkeit die wiederherzustellen ? abe ext3 als Dateisystem! Nein. ext3 ist gründlicher und es gibt kein undelete. -- [EMAIL PROTECTED] -- Haeufig gestellte Fragen und Antworten (FAQ): http://www.de.debian.org/debian-user-german-FAQ/ Zum AUSTRAGEN schicken Sie eine Mail an [EMAIL PROTECTED] mit dem Subject unsubscribe. Probleme? Mail an [EMAIL PROTECTED] (engl)
Re: Undelete unter Linux
Tach auch! Am Fre, den 08 November 2002, schrieb Thorsten von Plotho-Kettner: Am Freitag, 8. November 2002 09:06 schrieb Torsten Werner: Am 07. November 2002 schrieb Sebastian Schinzel: ich habe hier jemanden, der ca. 30GB Daten versehendlich auf seinem Debian-Server gelöscht hat. Die Platte wurde bald danach geumounted. Version ist ein aktuelles Woody und Filesystem ist ext3. Schuß ins Blaue. Versuch mal lde (Linux Disk Editor). Habe mich aber schon (zu) lange nicht mehr mit ihm beschäftigt. sicherlich wäre es unverantwortlich, wenn ein Produktivsystem mit dieser Datenmenge ohne backups geführt wird, aber ich denke, wenn er eines hätte, hätte er es eingespielt. So hilft dein (immerhin durch ein ;-) gekennzeichnetes) Hilfsangebot sicherlich wenig. Ohne Backup muß er so ein Risiko tragen. Dieter -- Registrierter Linux Benutzer #186360 - GnuPG Key-ID: 1024D/FDE465C9 Bevorzugt verschluesselte eMails. Nichts ist wie es scheint, alles ist erlaubt! msg24654/pgp0.pgp Description: PGP signature
Re: Undelete unter Linux
Am 07. November 2002 schrieb Sebastian Schinzel: ich habe hier jemanden, der ca. 30GB Daten versehendlich auf seinem Debian-Server gelöscht hat. Die Platte wurde bald danach geumounted. Version ist ein aktuelles Woody und Filesystem ist ext3. Ein undelete wie bei ext2 funktioniert bei ext3 nicht, weil der ext3-Treiber beim Löschen einer Datei die Blockverweise im Inode mit Nullen überschreibt. Aber spiel doch einfach das Backup zurück. ;-) Torsten -- Torsten Werner Dresden University of Technology mailto:email;twerner42.detelephone: +49 (351) 463 36711 http://www.twerner42.de/ telefax: +49 (351) 463 36809 -- Häufig gestellte Fragen und Antworten (FAQ): http://www.de.debian.org/debian-user-german-FAQ/ Zum AUSTRAGEN schicken Sie eine Mail an [EMAIL PROTECTED] mit dem Subject unsubscribe. Probleme? Mail an [EMAIL PROTECTED] (engl)
Re: Undelete unter Linux
Hallo, Am Freitag, 8. November 2002 09:06 schrieb Torsten Werner: Am 07. November 2002 schrieb Sebastian Schinzel: ich habe hier jemanden, der ca. 30GB Daten versehendlich auf seinem Debian-Server gelöscht hat. Die Platte wurde bald danach geumounted. Version ist ein aktuelles Woody und Filesystem ist ext3. Ein undelete wie bei ext2 funktioniert bei ext3 nicht, weil der ext3-Treiber beim Löschen einer Datei die Blockverweise im Inode mit Nullen überschreibt. Aber spiel doch einfach das Backup zurück. ;-) sicherlich wäre es unverantwortlich, wenn ein Produktivsystem mit dieser Datenmenge ohne backups geführt wird, aber ich denke, wenn er eines hätte, hätte er es eingespielt. So hilft dein (immerhin durch ein ;-) gekennzeichnetes) Hilfsangebot sicherlich wenig. Gruß, ThorauchichmusstedieNotwenigkeitvonBackupsschmerzlichlernensten -- Registrierter Linuxuser #275535 Wo stellt eigentlich MS die ISOs für diese XP-Distribution zum Download bereit? - eDonkey? ;-) (Michael Schulz in der Suse-ML) -- Häufig gestellte Fragen und Antworten (FAQ): http://www.de.debian.org/debian-user-german-FAQ/ Zum AUSTRAGEN schicken Sie eine Mail an [EMAIL PROTECTED] mit dem Subject unsubscribe. Probleme? Mail an [EMAIL PROTECTED] (engl)
Undelete unter Linux
Hallo zusammen, ich habe hier jemanden, der ca. 30GB Daten versehendlich auf seinem Debian-Server gelöscht hat. Die Platte wurde bald danach geumounted. Version ist ein aktuelles Woody und Filesystem ist ext3. apt-cache search undelete brachte mich auf das tool recover, was offenbar vor kurzem gelöschte Inodes nach gewissen Suchkriterien durchsucht und anzeigt. Leider bricht recover nach einiger Zeit mit segmentation fault ab. Ich bin jetzt nach der Howto von http://www.praeclarus.demon.co.uk/tech/e2-undel/howto.txt gegangen und konnte die Informationen von einigen Hundert Inodes sichern. Jetzt die Frage: Kennt jemand eine Möglichkeit aus diesen Inodes via Skript o.Ä. grössere Mengen von Daten wiederherzustellen? Viele Grüsse, -- Sebastian Schinzel -- Häufig gestellte Fragen und Antworten (FAQ): http://www.de.debian.org/debian-user-german-FAQ/ Zum AUSTRAGEN schicken Sie eine Mail an [EMAIL PROTECTED] mit dem Subject unsubscribe. Probleme? Mail an [EMAIL PROTECTED] (engl)
Undelete für FAT32?
Guten Morgen, wie sollte es anders sein wenn man um diese Zeit noch am Rechner sitzt, man löscht Dateien, die eigentlich nicht gelöscht werden sollten. Dummerweise haben diese Dateien auf ner FAT32-Partition gelegen und ich kann nichts finden, was mir das unter Linux wieder herstellen kann. :( Hat vielleicht jemand nen Tip für mich? Vielen Dank im Voraus /dirk, der jetzt erstmal schlafen geht -- dirk haage| [EMAIL PROTECTED] advanced network technologies phone +49 (0)30 85 07 06 12 mobile +49 (0)178 DIRK HAAGE -- Häufig gestellte Fragen und Antworten (FAQ): http://www.de.debian.org/debian-user-german-FAQ/ Zum AUSTRAGEN schicken Sie eine Mail an [EMAIL PROTECTED] mit dem Subject unsubscribe. Probleme? Mail an [EMAIL PROTECTED] (engl)
Re: Undelete für FAT32?
[Dirk Haage]: Dummerweise haben diese Dateien auf ner FAT32-Partition gelegen und ich kann nichts finden, was mir das unter Linux wieder herstellen kann. :( Hat vielleicht jemand nen Tip für mich? Das Problem reduziert sich hier darauf, ob es für Linux einen Hex-Editor für die Festplatte gibt. Sollte eigentlich der Fall sein, habe ich aber noch nicht gebraucht. Such mal schön ;) Falls Du keine Verzeichnisse gelöscht hast und noch nicht geschrieben hast, ist nichts verloren. Beim Löschen wird nämlich einfach der erste Buchstabe des Dateinamens durch- hm, wie war das noch?- jedenfalls sieht das neue Zeichen aus wie ein Sigma. Du mußt einfach mit dem Hexeditor das Verzeichnis suchen und in der FAT das Sigma durch z.B. ein 'X' ersetzen. Umbenennen kannst Du die Datei dann wieder ganz normal. Habe ich vor Ewigkeiten nicht selten gemacht, mit dem Diskeditor von Norton. Früher wäre ich so vorgegangen: am Anfang der Partition starten, bis zur FAT blättern und anhand der dortigen Infos bis zu dem gewünschten Verzeichnis durchhangeln. Die dazu notwendigen Kenntnisse habe ich leider längst vergessen und die Dokus schon vor vielen Jahren weitervererbt. Falls in diesem Verzeichnis aber noch Dateien vorhanden sein sollten, könntest Du nach diesen Namen suchen und nach vorne blättern, bis du die zugehörige Sub-FAT gefunden hast. Dann einfach dieses Sigma ersetzen. Achja, selbst wenn ein Verzeichnis gelöscht sein sollte: auch hier hilft das Ersetzen des Sigma. Einfach nach einem Teil des Verzeichnisnamens suchen. Oder Du findest ein Luxus-Tool, das Dir diese Arbeit abnimmt ;) Puh -- hafi -- Häufig gestellte Fragen und Antworten (FAQ): http://www.de.debian.org/debian-user-german-FAQ/ Zum AUSTRAGEN schicken Sie eine Mail an [EMAIL PROTECTED] mit dem Subject unsubscribe. Probleme? Mail an [EMAIL PROTECTED] (engl)
Re: undelete unter linux!
Schau doch mal auf meine HP unter Links findest Du einen Link zu unerase Linux, wenn Du ungefähr die Dateigröße Deiner vermissten Datei weist hast Du vielleicht chancen. Ich hab mal eine Access Datenbank wiederhergestellt, hat zwar gedauert, aber funktioniert! Andy Beuth www.beuth.info Am Sam, den 08 Juni 2002, schrieb Rene Engelhard: Ich vermute nicht, da ext3 und reiserfs ja regelmig ein jornal auf die Das man Datein wiederherstellen kann muss beim Entwerfen des Dateisystems beruecksichtig werden. Fuer ext2 wurde das beruecksichtigt . Bei reiserfs weiss ich es nicht. (Bei xfs wurde es nicht beruecksichtigt). Platte schreiben, und Schreibzugriffe (die ja evtl, auch auf genau die Stellen auf der Platte landen koennen, wo die geloeschte Datei lag) sind nicht so gut fuer die Chancen, die Datei wiederherzustellen ;-) Jup, nicht so gut, aber man koennte Glueck haben. Es koennnte aber auch sein, dass ext3(/ext2(?)) vermeidet auf solche Stellen zu schreiben. Dieter -- Registrierter Linux Benutzer #186360 - GnuPG Key-ID: FDE465C9 Bevorzugt verschluesselte eMails. Nichts ist wie es scheint, alles ist erlaubt! -- Zum AUSTRAGEN schicken Sie eine Mail an [EMAIL PROTECTED] mit dem Subject unsubscribe. Probleme? Mail an [EMAIL PROTECTED] (engl)
undelete unter linux!
hi, ist es möglich daten die gelöscht sind unter linux wiederherstellen so was wie undelete unter dos. Dateisystem ist ext3, ext2, und reiserfs! Geht das? -- Mit freundlichen Grüssen Carsten Dirk mailto:[EMAIL PROTECTED] -- Zum AUSTRAGEN schicken Sie eine Mail an [EMAIL PROTECTED] mit dem Subject unsubscribe. Probleme? Mail an [EMAIL PROTECTED] (engl)
Re: undelete unter linux!
Hallo Carsten, * Carsten Dirk schrieb [08-06-02 15:46]: ist es möglich daten die gelöscht sind unter linux wiederherstellen so was wie undelete unter dos. Dateisystem ist ext3, ext2, und reiserfs! Geht das? apt-cache search undelete? - ext2/3 geht wohl, dauert nur, reiser weiss ich so nicht. Gruss Udo -- Einmal im Monat ist meine Frau freundlich zu mir. Sie sagt dann Herr und Sie zu mir. Her mit dem Geld; sieh zu, daß du mehr verdienst msg09907/pgp0.pgp Description: PGP signature
Re[2]: undelete unter linux!
Guten Tag Udo Mueller, leider funkz. das nur für ext2. Gibt es nichts für ext3 und reserfs? Am Samstag, 8. Juni 2002 um 15:49 schrieben Sie: Udo Mueller Hallo Carsten, Udo Mueller * Carsten Dirk schrieb [08-06-02 15:46]: ist es möglich daten die gelöscht sind unter linux wiederherstellen so was wie undelete unter dos. Dateisystem ist ext3, ext2, und reiserfs! Geht das? Udo Mueller apt-cache search undelete? - ext2/3 geht wohl, dauert nur, reiser weiss ich so nicht. Udo Mueller Gruss Udo -- Mit freundlichen Grüssen Carsten Dirkmailto:[EMAIL PROTECTED] -- Zum AUSTRAGEN schicken Sie eine Mail an [EMAIL PROTECTED] mit dem Subject unsubscribe. Probleme? Mail an [EMAIL PROTECTED] (engl)
Re: undelete unter linux!
On Sat, 08 Jun 2002 15:46:43 +0200, Carsten Dirk wrote: ist es möglich daten die gelöscht sind unter linux wiederherstellen so was wie undelete unter dos. Dateisystem ist ext3, ext2, und reiserfs! Geht das? Füre ext2 gibts ein nettes Tool: http://twerner.debian.net/ Reinhard -- Zum AUSTRAGEN schicken Sie eine Mail an [EMAIL PROTECTED] mit dem Subject unsubscribe. Probleme? Mail an [EMAIL PROTECTED] (engl)
Re: undelete unter linux!
Hallo Carsten, Carsten Dirk wrote: - ext2/3 geht wohl, dauert nur, reiser weiss ich so nicht. Ich vermute nicht, da ext3 und reiserfs ja regelmig ein jornal auf die Platte schreiben, und Schreibyugriffe (die ja evtl, auch auf genau die Stellen auf der Platte landen koennen, wo die geloeschte Datei lag) sind nicht so gut fuer die Chancen, die Datei wiederherzustellen ;-) Gre Rene msg09915/pgp0.pgp Description: PGP signature
Re: undelete unter linux!
Tach auch! Am Sam, den 08 Juni 2002, schrieb Rene Engelhard: Ich vermute nicht, da ext3 und reiserfs ja regelmig ein jornal auf die Das man Datein wiederherstellen kann muss beim Entwerfen des Dateisystems beruecksichtig werden. Fuer ext2 wurde das beruecksichtigt . Bei reiserfs weiss ich es nicht. (Bei xfs wurde es nicht beruecksichtigt). Platte schreiben, und Schreibzugriffe (die ja evtl, auch auf genau die Stellen auf der Platte landen koennen, wo die geloeschte Datei lag) sind nicht so gut fuer die Chancen, die Datei wiederherzustellen ;-) Jup, nicht so gut, aber man koennte Glueck haben. Es koennnte aber auch sein, dass ext3(/ext2(?)) vermeidet auf solche Stellen zu schreiben. Dieter -- Registrierter Linux Benutzer #186360 - GnuPG Key-ID: FDE465C9 Bevorzugt verschluesselte eMails. Nichts ist wie es scheint, alles ist erlaubt! msg09954/pgp0.pgp Description: PGP signature
Re: undelete unter linux!
Hallo Carsten, Hallo Liste, Am Samstag, 8. Juni 2002 15:58 schrieb Carsten Dirk: Guten Tag Udo Mueller, leider funkz. das nur für ext2. Gibt es nichts für ext3 und reserfs? soweit ich weiß nein, aber falls Du generell eine Lösung suchst um versehentlich gelöschte Daten wieder herzustellen ist das Paket libtrash (testing/unstable) vielleicht interessant für Dich: libtrash: A trash can library to use with LD_PRELOAD gruß andreas well -- Zum AUSTRAGEN schicken Sie eine Mail an [EMAIL PROTECTED] mit dem Subject unsubscribe. Probleme? Mail an [EMAIL PROTECTED] (engl)
Re: Help!!! undelete for ext3fs!!!
On Fri, Mar 01, 2002 at 06:28:30PM -0600, Cheryl Homiak wrote: Well, it really is too late now, as this was my root partition and I couldn't unmount it immediately even if I had known what to do. I had already looked at Midnight commander but your additions were helpful as I only saw the information about undeleting from the command line. The information wasn't life-or-death and I learned a lot in the process. As for backups, I'm really sorry but i can't figure out what a MO disk is. Unfortunately, the only facilities I have right now for doing backup of any kind is the old floppy, and I probably should have had this data on floppy. I'd love to have a backup system, and you'll get no argument from me against its importance, but the reality is that I don't have one right now. No, it isn't. For backups that prevent against accidental erasure of a file, do a man rcsintro if you are only worried about text files, and man cvs if you have to work with binary files. This incident also points out the wisdom in having your linux system mounted on several partitions so that in cases like this you can unmount the partition immediately. As for the trash can, it wouldn't do any good if your hard disk breaks but could be an asset in momentarily slips of the fingers (or the brain) such as I had. Disks don't go bad nearly as often as people have thinkos. -- Share and Enjoy.
Re: Help!!! undelete for ext3fs!!!
On Sun, Mar 03, 2002 at 09:22:14PM +0100, Paul Seelig wrote: [EMAIL PROTECTED] (Brian Potkin) writes: The man page for Midnight Commander claims that undeletion is possible only with an ext2 file system. Your suggestion to explore whether it would deal with ext3 is reasonable but doesn't mc use debugfs which is designed for an ext2 file system? Writing from the perspective of an up to date Debian/unstable system only (i really can't be bothered with this rotten potato anymore): debugfs is part of the e2fsprogs package which in turn is ext3-aware. I took what the man page for mc said at face value and didn't dig any further to look in detail at the e2fsprogs documentation. Thanks for the correction; it gives me some incentive to make an ext3 partition and test how debugfs deals with deleted files on it. I was aware that Midnight Commander has the facility you describe so I used it. It told me it was `loading deleted files information' and was still going strong after an hour. I went to bed, dreamt of inodes, got up and there it was still churning away. Having become curious after writing my message, i tried this as well on an ext3 filesystem with similar effect. But i was not patient enough to stand the procedure for more than an hour... ;-) This behaviour appears to be a bug in mc and has been reported in bug report #121917. Now that partition only has about 50M of free space so I suspect there is insufficient room to write the undeleted files to it. Even if you wanted to, you simply couldn't and you better wouldn't, even if you could because you wouldn't want to use those unlinked inodes to be overwritten by restoring your files. The last time i succesfully undeleted using MC (almost two years ago) i tried this and the undeletion routine refused writing data onto the same partition. A couple of hours after making this statement it struck me that writing to an unmounted partition is not likely to succeed. A way to direct the file listing somewhere else would be useful. What should this be good for? Not much! Basically, I was having difficulty understanding mc's behaviour and not having used it for this purpose before I made the mistake of assuming it was copying the files and required room to write them out somewhere. Brian.
Re: Help!!! undelete for ext3fs!!!
[EMAIL PROTECTED] (Brian Potkin) writes: The man page for Midnight Commander claims that undeletion is possible only with an ext2 file system. Your suggestion to explore whether it would deal with ext3 is reasonable but doesn't mc use debugfs which is designed for an ext2 file system? Writing from the perspective of an up to date Debian/unstable system only (i really can't be bothered with this rotten potato anymore): debugfs is part of the e2fsprogs package which in turn is ext3-aware. I was aware that Midnight Commander has the facility you describe so I used it. It told me it was `loading deleted files information' and was still going strong after an hour. I went to bed, dreamt of inodes, got up and there it was still churning away. Having become curious after writing my message, i tried this as well on an ext3 filesystem with similar effect. But i was not patient enough to stand the procedure for more than an hour... ;-) Now that partition only has about 50M of free space so I suspect there is insufficient room to write the undeleted files to it. Even if you wanted to, you simply couldn't and you better wouldn't, even if you could because you wouldn't want to use those unlinked inodes to be overwritten by restoring your files. The last time i succesfully undeleted using MC (almost two years ago) i tried this and the undeletion routine refused writing data onto the same partition. A way to direct the file listing somewhere else would be useful. What should this be good for? Imagine a lot of .deb files. Imagine having to rename them correctly! The tedium involved, however, is very much offset by the pleasure of recovering them. I'm feeling with you. ;-) Eventually I used the recover package from the testing distribution. You can select deleted files by date and time of deletion and dump them to a directory on another partition. It was also quite quick. Having read about the difficulty of undeleting files on unix systems I found the performance of this program impressive. Thanks for the hint! I wasn't aware about the usefulness of this! :-) Thanks, P. *8^) -- Paul Seelig [EMAIL PROTECTED] -- African Music Archive - Institute for Ethnology and Africa Studies Johannes Gutenberg-University - Forum 6 - 55099 Mainz/Germany - http://ntama.uni-mainz.de --
Re: Help!!! undelete for ext3fs!!!
On Fri, Mar 01, 2002 at 06:28:30PM -0600, Cheryl Homiak wrote: [snip] As for backups, I'm really sorry but i can't figure out what a MO disk is. I think this is tech speak for a magneto-optical disk, which is a rare beast that I've never actually seen, only heard about. You may google the web for more info about them. Unfortunately, the only facilities I have right now for doing backup of any kind is the old floppy, and I probably should have had this data on floppy. Take it from someone who lived in DOS World for over ten years, floppy backup is about as good as no backup at all. Maybe worse, since you might have a false sense of security. Floppies are hideously unreliable, and just too small to back up present-day large hard disks. The only thing I use floppies for nowadays is to pass small files to friends who don't have Net connections, and for emergency boot disks. And I always make *three* of those at a crack, since I'm as likely to find a corrupted sector on the diskette when I need it as I am to boot a kernel. They like to fail at the most inconvenient times. I'd love to have a backup system, and you'll get no argument from me against its importance, but the reality is that I don't have one right now. CD-Rs work okay for people who don't have large amounts of data to back up, and they are an inexpensive solution. For large amounts of data, tape, preferably SCSI, would seem to be a common recommendation from the old hands on Linux lists. Problem is that a drive that can back up a large disk won't be cheap. Add the cost of a set of tapes to rotate backups, and the cost of a good SCSI board if you don't already have a SCSI channel on your machine, and you're talking a good chunk of change. I use a poor man's remedy: I back up to my second hard drive. This is a cold swap IDE drive. I have one disk in the bay to which I back up, and two extra to rotate. One is always off-site at my locker at work, and I tote them back and forth when I go to work to rotate the backups. Since the backups are compressed, and I don't back up anything I can recreate from my Debian installation CDs, I can get away with smaller drives for the backup bay than for the primary disk. The backup disks have either been cannibalized from older systems, or bought for cheap at used computer shops. Not an ideal solution, by any means, but it works for some values of works. At least I can back up everything that needs backing up on a single medium, so unattended backups are possible, and the disk-to-disk transfers are pretty fast. And it was a lot cheaper than DDS. Just $0.02 worth. Cordially, Mark S. Reglewski
Re: Help!!! undelete for ext3fs!!!
On Fri, Mar 01, 2002 at 08:38:05PM +0100, Paul Seelig wrote: On Thu, Feb 28, 2002 at 11:42:36PM -0600, Cheryl Homiak wrote: I just deleted something I didn't want to delete; won't hurt my system, just destroyed some important records I was keeping. *Immediately* unmount the partition holding this data! With *immediately* i mean *IMMEDIATELY!*, or better put, RIGHT *NOW*! An now let's just calm down to be able to think for a minute. A few days ago my fingers typed the command `apt-get clean'. What my brain intended was `apt-get autoclean'. Fortunately, I keep package files on a separate ext2 partition so unmounting it was quick and easy. I realise the deleted data are replaceable but 400M+ takes a long time to download on a modem link so I took the opportunity to have a look at how easy or hard it was to recover the files. If I failed to get them back it wouldn't be disastrous but it was annoying to have made a mistake with a command I was familiar with. Is there any way to undelete in ext3fs? Since this is compatible with ext2, ext2 undeletion should be possible. Now you have the possibility to find out yourself and tell us whether this worked or not. The man page for Midnight Commander claims that undeletion is possible only with an ext2 file system. Your suggestion to explore whether it would deal with ext3 is reasonable but doesn't mc use debugfs which is designed for an ext2 file system? There is a comfortable way for undeletion using the GNU Midnight Commander, /usr/bin/mc. If you have it installed, then start it up, press F9 and choose Command | Undelete files (ext2fs only). Enter the device file name without the leading /dev/ of the (hopefully unmounted!) partition containing the deleted files and wait a few minutes until the panel contains a listing of deleted files. Depending on size of the partition in question, this can take up a considerable amount of time. So please be patient even if this takes half an hour or even far more. I was aware that Midnight Commander has the facility you describe so I used it. It told me it was `loading deleted files information' and was still going strong after an hour. I went to bed, dreamt of inodes, got up and there it was still churning away. Now that partition only has about 50M of free space so I suspect there is insufficient room to write the undeleted files to it. A way to direct the file listing somewhere else would be useful. The files in the resulting list don't carry names anymore and the shown names are probably mere inode numbers(?) or similar. Check which file(s) might contain the data in question and copy this file into a directory located on *another* partition. Imagine a lot of .deb files. Imagine having to rename them correctly! The tedium involved, however, is very much offset by the pleasure of recovering them. And if you've been able to save your data: Rejoice! Eventually I used the recover package from the testing distribution. You can select deleted files by date and time of deletion and dump them to a directory on another partition. It was also quite quick. Having read about the difficulty of undeleting files on unix systems I found the performance of this program impressive. [Snip good advice on backups] Brian.
Re: Help!!! undelete for ext3fs!!!
[EMAIL PROTECTED] (Cheryl Homiak) writes: Well, it really is too late now, as this was my root partition and I couldn't unmount it immediately even if I had known what to do. Maybe you could still save some fragments of the file? or if you are *really* lucky, the relvant inodes still have not been overwritten? In such cases it's nice to have another Linux system on removable media like a CD-R or similar. This way you could have simply rebooted from this second system and repair from there. There is a *very* nice full Debian live system on a single CD-R which runs directly from CD without the need of an installation called KNOPPIX. Boots right into a full featured KDE session with full access of hundreds of applications. Check out http://www.knopper.net/knoppix/; to learn more about it. I use it as full featured rescue disk and installation media for new desktop installations. for backups, I'm really sorry but i can't figure out what a MO disk is. This is a magneto optical disk. It is similar to ZIP and floppy disks in size but has capacities from 128 MB up to 2.3 GB and is virtually undestroyable by magnetic influences, etc. There exist 5.25 disks and drives with capacities up to 9.1GB as well. MO is IMHO the only really safe way for storing any data, albeit not very widespread and the drives tend to be quite costly. But one can easily aquire older models at eBay for cheaper prices. That's what i did. I have a 5.2GB drive from Sony and a 640MB drive from Fujitsu. ;-) For more information, check out http://mo.fujitsu.com/global/;, http://www.sony-cp.com/_E/Products/Storage/MO/rmo-s551.html;, http://www.sony-cp.com/_E/Products/Storage/MO/Index.html;, and http://www.olympus-europa.com/mo/;. Maybe a CD-RW might be of some practical use, but what i like so much about MO disks is that one can use them like any other file system. This incident also points out the wisdom in having your linux system mounted on several partitions so that in cases like this you can unmount the partition immediately. Just take into account that such deep wisdom shouldn't force it's cleverness upon oneself and become impractical. The only file system layout i'd bother about for a desktop machine would consist of only three partions. One each for swap space, / and /home/. Just for private use, anything else would be only overkill. If you don't mind reinstalling programs from Debian packages, backups should only be made regularily from /etc/, /home/ and /var/. But restoring (and cloning!) a system from a full backup might save quite some time in case of an actual incident. As for the trash can, it wouldn't do any good if your hard disk breaks but could be an asset in momentarily slips of the fingers (or the brain) such as I had. Yes, in this case it might prove to be useful. Generally, it's a good idea *not* to trust oneself. Therefore it's as well a bad idea to work only as the super user. Been there, done that, suffered from the consequences, and, rightfully so, got no t-shirt. ;-) Cheers, P. *8^) -- Paul Seelig [EMAIL PROTECTED] -- African Music Archive - Institute for Ethnology and Africa Studies Johannes Gutenberg-University - Forum 6 - 55099 Mainz/Germany - http://ntama.uni-mainz.de --
Help!!! undelete for ext3fs!!!
I just deleted something I didn't want to delete; won't hurt my system, just destroyed some important records I was keeping. Is there any way to undelete in ext3fs? And if there is a way, but you had to have it pre-set up before the catastrophe occurred, I'd still like to know about it so I will have a safeguard in the future. I can only find references to undeletion for ext2fs. TIA. -- Cheryl
Re: Help!!! undelete for ext3fs!!!
High, On Thu, 28 Feb 2002, Cheryl Homiak wrote: I just deleted something I didn't want to delete; won't hurt my system, just destroyed some important records I was keeping. Is there any way to undelete in ext3fs? Ouch, no idea. And if there is a way, but you had to have it pre-set up before the catastrophe occurred, I'd still like to know about it so I will have a safeguard in the future. You can setup some kind of Trashcan yourself. Make a directory on your system somewhere and make an alias for rm: alias rm = 'mv ? /tmp/Trashcan' not sure about the ? which should be the filename. Or write a script for this. If you are on a multiuser system, you definitely have to write a script, which moves the deleted files into subdirs in the Trashcan which are unreadable by other users. Greetz, Sebastiaan
Re: Help!!! undelete for ext3fs!!!
I did this, once but it was a pain. It was under ext2 instead of ext3 but that shouldn't matter in this case. It also required knowledge of some of the contents of the file and wasn't very useful for binary files. You essentially boot without mounting the filesystem on which you want to 'undelete' (or you unmount after boot if not the root partition and after killing all daemons that use the target filesystem). Then you grep the device (eg /dev/sdb1) for some part of the file you want and have it spew so many bytes before and after what you are looking for so that you can see where the start/stop of the file is. Once you have that you use a comand (dd? or something) to copy those bytes from that location on the device to a file on an already mounted file system and poof, you have it back. I know this is rather vague but you get the idea of the approach. I wish I could give you more detail but I did this around 4 years ago and haven't really needed to do much like it since. vec - Original Message - From: Sebastiaan [EMAIL PROTECTED] To: Cheryl Homiak [EMAIL PROTECTED] Cc: debian-user@lists.debian.org Sent: Friday, March 01, 2002 12:19 AM Subject: Re: Help!!! undelete for ext3fs!!! High, On Thu, 28 Feb 2002, Cheryl Homiak wrote: I just deleted something I didn't want to delete; won't hurt my system, just destroyed some important records I was keeping. Is there any way to undelete in ext3fs? Ouch, no idea. And if there is a way, but you had to have it pre-set up before the catastrophe occurred, I'd still like to know about it so I will have a safeguard in the future. You can setup some kind of Trashcan yourself. Make a directory on your system somewhere and make an alias for rm: alias rm = 'mv ? /tmp/Trashcan' not sure about the ? which should be the filename. Or write a script for this. If you are on a multiuser system, you definitely have to write a script, which moves the deleted files into subdirs in the Trashcan which are unreadable by other users. Greetz, Sebastiaan -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: Help!!! undelete for ext3fs!!!
hi ya dumb question/comment... since ext3 is just ext2 w/ journalling... - can you just unplay the journal ??? :-) otherwise to undelete ext2 files... and if you did undelete it successfullye... i donno what happens to your journaled fs http://www.Linux-Sec.net/Txt/erase.txt ( look for restore deleted files ) aliasing rm is a sorta whacky way to solve some of the accidental delete problems.. have fun linuxing alvin On Fri, 1 Mar 2002, Sebastiaan wrote: High, On Thu, 28 Feb 2002, Cheryl Homiak wrote: I just deleted something I didn't want to delete; won't hurt my system, just destroyed some important records I was keeping. Is there any way to undelete in ext3fs? Ouch, no idea. And if there is a way, but you had to have it pre-set up before the catastrophe occurred, I'd still like to know about it so I will have a safeguard in the future. You can setup some kind of Trashcan yourself. Make a directory on your system somewhere and make an alias for rm: alias rm = 'mv ? /tmp/Trashcan'
Re: Help!!! undelete for ext3fs!!!
Sebastiaan [EMAIL PROTECTED] writes:
Is there any way to undelete in ext3fs?
I'm not shure if this works but I would give the normale recover for
ext2 a try. Before using it you should umount the partition. And in
the meantime you should use the partition read-only to get a chance
that the deleted inodes aren't assigned to new files.
You can setup some kind of Trashcan yourself. Make a directory on your
system somewhere and make an alias for rm:
alias rm = 'mv ? /tmp/Trashcan'
alias rm = 'mv --backup=numbered --target-directory=/tmp/Trashcan'
If you want to use a parameter within aliases, you have to use
functions instead:
function rm { mv $* /tmp/Trashcan }
Obviously, all this only works in Bourne Shell derivates like bash.
If you are on a multiuser system, you definitely have to write a
script, which moves the deleted files into subdirs in the Trashcan
which are unreadable by other users.
alias rm = 'mkdir -m 0700 -p /tmp/Trashcan/$USER \
mv --backup=numbered --target-directory=/tmp/Trashcan/$USER'
[x] ulf
--
Der Mensch ist immer noch der beste Computer. (John F. Kennedy)
Re: Help!!! undelete for ext3fs!!!
Ulf Rompe, 2002-Mar-01 10:25 +0100: alias rm = 'mv --backup=numbered --target-directory=/tmp/Trashcan' This is nice, and I'm starting to use this from my root and user account on my laptop. However, how would I delete from the Trashcan, save removing the alias temporarily? thanks, jc -- Jeff CoppockSystems Engineer Diggin' Debian Admin and User
Re: Help!!! undelete for ext3fs!!!
On Thu, Feb 28, 2002 at 11:42:36PM -0600, Cheryl Homiak wrote: I just deleted something I didn't want to delete; won't hurt my system, just destroyed some important records I was keeping. *Immediately* unmount the partition holding this data! With *immediately* i mean *IMMEDIATELY!*, or better put, RIGHT *NOW*! An now let's just calm down to be able to think for a minute. Is there any way to undelete in ext3fs? Since this is compatible with ext2, ext2 undeletion should be possible. Now you have the possibility to find out yourself and tell us whether this worked or not. There is a comfortable way for undeletion using the GNU Midnight Commander, /usr/bin/mc. If you have it installed, then start it up, press F9 and choose Command | Undelete files (ext2fs only). Enter the device file name without the leading /dev/ of the (hopefully unmounted!) partition containing the deleted files and wait a few minutes until the panel contains a listing of deleted files. Depending on size of the partition in question, this can take up a considerable amount of time. So please be patient even if this takes half an hour or even far more. The files in the resulting list don't carry names anymore and the shown names are probably mere inode numbers(?) or similar. Check which file(s) might contain the data in question and copy this file into a directory located on *another* partition. And if you've been able to save your data: Rejoice! And if there is a way, but you had to have it pre-set up before the catastrophe occurred, I'd still like to know about it so I will have a safeguard in the future. The only true safeguard is a regular backup. Other good possibilities include a regular backup or possibly even a regular backup. Some people even go so far to claim that a regular backup is the only worthwhile protection system because it transcends the limits of you hard disk and computer live span. Among the multitude of choices just presented i'd always favour a regular backup. ;-) I wouldn't bother about a trash can facility because if your hard disk breaks your trash can will be broken too. Backups don't get broken when your hard disk fails *and* when made on secure media like MO disks (that's what i use and trust). If the data in question is *really* important i'd take responsibility to store various generations of backup media in another room, floor, building or even city. Linus himself and most Free Software developers even chose to spread their data over various continents... ;-) Good luck, P. *8^) -- If not specific to HP please always reply to Paul Seelig [EMAIL PROTECTED]
Re: Help!!! undelete for ext3fs!!!
On Fri, Mar 01, 2002 at 10:12:51AM -0800, Jeff wrote: Ulf Rompe, 2002-Mar-01 10:25 +0100: alias rm = 'mv --backup=numbered --target-directory=/tmp/Trashcan' This is nice, and I'm starting to use this from my root and user account on my laptop. However, how would I delete from the Trashcan, save removing the alias temporarily? Specify the full path to the rm command, as this prevents alias substitution: $ /bin/rm filename -- Karl E. Jørgensen [EMAIL PROTECTED] www.karl.jorgensen.com /\ \ / ASCII Ribbon Campaign x - Say NO to HTML in email / \ - Say NO to Word documents in email (and Macros!) pgpvFP1v47Efk.pgp Description: PGP signature
Re: Help!!! undelete for ext3fs!!!
Jeff [EMAIL PROTECTED] writes: Ulf Rompe, 2002-Mar-01 10:25 +0100: alias rm = 'mv --backup=numbered --target-directory=/tmp/Trashcan' This is nice, and I'm starting to use this from my root and user account on my laptop. However, how would I delete from the Trashcan, save removing the alias temporarily? ``/bin/rm'' or ``\rm'' will execute th rm binary, not the alias. Bob -- _ |_) _ |_ Robert D. Hilliard [EMAIL PROTECTED] |_) (_) |_) 1294 S.W. Seagull Way [EMAIL PROTECTED] Palm City, FL USA GPG Key ID: 390D6559 PGP Key ID: A8E40EB9
Re: Help!!! undelete for ext3fs!!!
Lo, on Friday, March 1, Jeff did write: Ulf Rompe, 2002-Mar-01 10:25 +0100: alias rm = 'mv --backup=numbered --target-directory=/tmp/Trashcan' This is nice, and I'm starting to use this from my root and user account on my laptop. However, how would I delete from the Trashcan, save removing the alias temporarily? /bin/rm /tmp/Trashcan/whatever Specifying the full path blocks alias/function expansion. Richard
Re: Help!!! undelete for ext3fs!!!
Well, it really is too late now, as this was my root partition and I couldn't unmount it immediately even if I had known what to do. I had already looked at Midnight commander but your additions were helpful as I only saw the information about undeleting from the command line. The information wasn't life-or-death and I learned a lot in the process. As for backups, I'm really sorry but i can't figure out what a MO disk is. Unfortunately, the only facilities I have right now for doing backup of any kind is the old floppy, and I probably should have had this data on floppy. I'd love to have a backup system, and you'll get no argument from me against its importance, but the reality is that I don't have one right now. This incident also points out the wisdom in having your linux system mounted on several partitions so that in cases like this you can unmount the partition immediately. As for the trash can, it wouldn't do any good if your hard disk breaks but could be an asset in momentarily slips of the fingers (or the brain) such as I had. If anybody does try this with the ext3fs, I would be very interested in a post re: the results. thanks to everybody for their suggestions; I also discovered the undeletion howto and the recovery program due to a combination of my own searching and people's comments. By the way, I learned before i ever started linux that panic is the surest way to complicate an already bad situation, so that was never an issue. -- Cheryl
Re: undelete for ext2
I was once asked whether or not GNU/Linux had any features to prevent users from doing bone-headed stupid things. Yes, I said. Bitter experience. Sometimes, even that isn't enough - especially when you are me. I have been through all the requirements to properly back up data and such which is followed to the letter on my machine @ work cos it does have vital data. For my home computer however, the amount of work required to do all these things seems to be far too much work to do to merely minimize risk - and I tend to get at with it MOST of the time. And if it wasn't for plain utter stupidity, it probably would've have been fine as well. There wasn't really any vital data on the HD anyway and i suppose a full re-install would be easier than going through all the backup procedures. This also gives me an opportunity to repartition better to start off with. Thanx for your help and also for the link to the partitioning mini-FAQ - I've been looking for something like that for ages. Regards, Shri __ Do You Yahoo!? Make international calls for as low as $.04/minute with Yahoo! Messenger http://phonecard.yahoo.com/
Re: undelete for ext2
on Sun, Aug 05, 2001 at 08:16:08AM -0700, Shriram Shrikumar ([EMAIL PROTECTED]) wrote: Hi All, It was pleasant afternoon when I realised that maybe, today would be a good day to move the /var partition just to / so I can use the extra space elsewhere and / had a couple of hundred megs not being used. I went into singe user mode and then, cd / mkdir var2 cd /var mv * /var2 after churning around for a while, it gave up and told me that there was no space. I gave up on moving var the var parition and before thinking gave cd / rm var2 -r Thus started my adventure into ext2 undeletion software. ... Any help appreciated. I was once asked whether or not GNU/Linux had any features to prevent users from doing bone-headed stupid things. Yes, I said. Bitter experience. You've just learned something. Your data is, in all likelihood, gone. You might get parts of it back, but a complete restore is very unlikely, and will be quite time consuming. - Buy yourself a backup system. I recommend DAT tape, CDR, or alternate networked storage. - Use it. - Take appropriate measures before you do any serious mucking with your partitions in the future. E.g.: don't 'mv' data, copy it. This leaves you with two images of the data, in the event one goes bad. Your going to single-user mode was the one smart thing you'd done -- this minimizes any changes to data while you're working. Better yet, boot a rescue system and mount the partitions you're doing surgery on someplace outside the normal filesystem heirarchy. My MO for any filesystem surgery is: - Go single-user or boot a rescue system. Do *both* the following: - Create tape backups of data to be moved. - Create filesystem backups (either locally, if space permits, or networked to another station). This provides redundant backups, and gives me one fast method for restoring data (the filesystem backups). - VERIFY YOUR BACKUPS. Missing, incomplete, or inaccurate backups won't do much for you. - *COPY* data from old to new locations. Various means work, I prefer the older: $ tar cvf - old dir/* | ( cd new dir; tar xvf - ) - *VERIFY* the move: $ diff --recursive --brief old-dir new-dir - Rename the old tree, and move the new tree to its location. Change mount points if appropriate. - Resume multi-user operation or reboot system. Sniff around. If there are any problems, you've still got: - A tape archive. - A disk archive. - The old disk tree. - After a suitable test period (minutes, hours, days, your option), go ahead and recycle your old bytes by nuking the old directory. Yes, as a general consequence, repartitioning is a somewhat time-consuming operation. This is one of the reasons I try to shoot for a good, long-lived partitioning schema on my boxen. For general backup suggestions: http://kmself.home.netcom.com/Linux/FAQs/backups.html Partitioning suggestions: http://kmself.home.netcom.com/Linux/FAQs/partition.html Cheers. -- Karsten M. Self kmself@ix.netcom.comhttp://kmself.home.netcom.com/ What part of Gestalt don't you understand? There is no K5 cabal http://gestalt-system.sourceforge.net/ http://www.kuro5hin.org Free Dmitry!! Boycott Adobe!! Repeal the DMCA!! http://www.freesklyarov.org Geek for Hire http://kmself.home.netcom.com/resume.html pgpILnXEPdpNJ.pgp Description: PGP signature
Re: undelete for ext2
Shriram Shrikumar [EMAIL PROTECTED] writes: it seems to find the deleted inodes and then tries to dump them in a specified folder which leaves me with a lot of dump files - anybody with any clues as to what I can do with these files to put them back where they belong ? or maybe even a better undelete sofware. Hmm, restore your backup. ;-) The file names were stored in the directory entries, which likely have been overwritten during the deletion process. So the best thing is to recover the essential data (e.g., mailboxes), and just reinstall the system (after a backup). -- Florian Weimer[EMAIL PROTECTED] University of Stuttgart http://cert.uni-stuttgart.de/ RUS-CERT +49-711-685-5973/fax +49-711-685-5898
