Re: Undeleting files
Thanks for the options. I ended up using extundelete. First flashcopy the 3390-3 that this directory was on. Never take a chance on making things worse. Backup first. The files lost were VSE Virtual Tape files. I could mount the real 3420 volumes again and copy them to virtual tape, so that was my fall back solution. When I undeleted the files to an empty 3390-3, it filled up the volume. So I ended up allocating a 3390-9 to hold the undeleted files. (used 35% of the mod 9) extundelete came up with over 300 files. Most of them failed in the undelete process. This seemed to be from older files that existed that were deleted and the space reused, most likely by my virtual tapes. The process didn't produce any filenames. Everything was recreated as "file.xxx" where xxx is a number, perhaps a directory block id or something. So I ended up running each file thru tapemap to see what was on it. Also, the tape hdr label would tell me the volser which is what I used as a filename. Long process. Took about 4 hours to recover 59 tape files and map them which also validated there was a trailing tapemark. I had an existing "dir" list of the directory I accidently deleted. So I knew what files should be there and their filesize. Only 1 file was not recoverable. I think that was pretty good. Good work for a Friday.. Tom Duerbusch THD Consulting >>> Rafael Godinez Perez 12/15/2011 4:05 AM >>> El 14/12/11 23:00, Tom Duerbusch escribió: > Where I know the answer to this question, generally. I wonder if this can be done in a very defined sitituation. > > I have disk "/dev/dasdb1", formatted with ext3. > There is one directory on it. > That directory had about 40 files on it of a few megabytes each. > This is SLES 10 SP 2. > > I connected to the Linux image with WINSCP. > I bought up that directory in one pane and in the other pane, I bought up my thumb drive. > I wanted to copy the files to my thumb drive. > > Instead of copying the files, I thought syncing the directories would be easier. > Well, I synced an empty directory to the Linux directory. All files are gone. > > In most cases, recovering deleted files is very dependant on if any of the space or directory structure has been reused. In this case, the space hasn't been reused, but I don't know if the deletion of 40 files, one at a time, would reuse the directory blocks or just mark them available. > > Before I go too far in this > Am I just out of luck? > Or is there a decent chance I can recover these files? > > Thanks > > Tom Duerbusch > THD Consulting > > -- > For LINUX-390 subscribe / signoff / archive access instructions, > send email to lists...@vm.marist.edu with the message: INFO LINUX-390 or visit > http://www.marist.edu/htbin/wlvindex?LINUX-390 > -- > For more information on Linux on System z, visit > http://wiki.linuxvm.org/ You may want to try this tool. It worked for me many times. http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step HTH, Rafa. -- Rafael Godínez Pérez Red Hat - Senior Solution Architect EMEA RHCE, RHCVA, RHCDS Tel: +34 91 414 8800 - Ext. 68815 Mo: +34 600 418 002 Dirección Comercial: C/Jose Bardasano Baos, 9, Edif. Gorbea 3, Planta 3ºD, 28016 Madrid, Spain Dirección Registrada: Red Hat S.L., C/ Velazquez 63, Madrid 28001, Spain Inscrita en el Reg. Mercantil de Madrid – C.I.F. B82657941 -- For LINUX-390 subscribe / signoff / archive access instructions, send email to lists...@vm.marist.edu with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 -- For more information on Linux on System z, visit http://wiki.linuxvm.org/ -- For LINUX-390 subscribe / signoff / archive access instructions, send email to lists...@vm.marist.edu with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 -- For more information on Linux on System z, visit http://wiki.linuxvm.org/
Re: Undeleting files
El 14/12/11 23:00, Tom Duerbusch escribió: > Where I know the answer to this question, generally. I wonder if this can be > done in a very defined sitituation. > > I have disk "/dev/dasdb1", formatted with ext3. > There is one directory on it. > That directory had about 40 files on it of a few megabytes each. > This is SLES 10 SP 2. > > I connected to the Linux image with WINSCP. > I bought up that directory in one pane and in the other pane, I bought up my > thumb drive. > I wanted to copy the files to my thumb drive. > > Instead of copying the files, I thought syncing the directories would be > easier. > Well, I synced an empty directory to the Linux directory. All files are gone. > > In most cases, recovering deleted files is very dependant on if any of the > space or directory structure has been reused. In this case, the space hasn't > been reused, but I don't know if the deletion of 40 files, one at a time, > would reuse the directory blocks or just mark them available. > > Before I go too far in this > Am I just out of luck? > Or is there a decent chance I can recover these files? > > Thanks > > Tom Duerbusch > THD Consulting > > -- > For LINUX-390 subscribe / signoff / archive access instructions, > send email to lists...@vm.marist.edu with the message: INFO LINUX-390 or visit > http://www.marist.edu/htbin/wlvindex?LINUX-390 > -- > For more information on Linux on System z, visit > http://wiki.linuxvm.org/ You may want to try this tool. It worked for me many times. http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step HTH, Rafa. -- Rafael Godínez Pérez Red Hat - Senior Solution Architect EMEA RHCE, RHCVA, RHCDS Tel: +34 91 414 8800 - Ext. 68815 Mo: +34 600 418 002 Dirección Comercial: C/Jose Bardasano Baos, 9, Edif. Gorbea 3, Planta 3ºD, 28016 Madrid, Spain Dirección Registrada: Red Hat S.L., C/ Velazquez 63, Madrid 28001, Spain Inscrita en el Reg. Mercantil de Madrid – C.I.F. B82657941 -- For LINUX-390 subscribe / signoff / archive access instructions, send email to lists...@vm.marist.edu with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 -- For more information on Linux on System z, visit http://wiki.linuxvm.org/
Re: Undeleting files
On Wed, 14 Dec 2011 16:00:52 -0600 Tom Duerbusch wrote: > Instead of copying the files, I thought syncing the directories would > be easier. Well, I synced an empty directory to the Linux directory. > All files are gone. I did some non-z testing a while back where I managed to recover an ext3 filesystem that had been quick formatted as NTFS. Seems home users do that a bit. For a newly created (ext3) filesystem that had a few files copied to it and then formatted - so managed test, not "real world" - mkfs.ext3 -S ... enabled all the files to be found by name and recovered. Note also the caveats in the manpage. Shane ... -- For LINUX-390 subscribe / signoff / archive access instructions, send email to lists...@vm.marist.edu with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 -- For more information on Linux on System z, visit http://wiki.linuxvm.org/
Re: Undeleting files
Hi Tom, Try google, there are some hits on recovering data on ext3. It might not be easy so it depends on how bad you need the deleted data. I've found for instance http://carlo17.home.xs4all.nl/howto/undelete_ext3.html, quite a long story but apparently it can be done. Regards, Berry. Op 14-12-11 23:00, Tom Duerbusch schreef: Where I know the answer to this question, generally. I wonder if this can be done in a very defined sitituation. I have disk "/dev/dasdb1", formatted with ext3. There is one directory on it. That directory had about 40 files on it of a few megabytes each. This is SLES 10 SP 2. I connected to the Linux image with WINSCP. I bought up that directory in one pane and in the other pane, I bought up my thumb drive. I wanted to copy the files to my thumb drive. Instead of copying the files, I thought syncing the directories would be easier. Well, I synced an empty directory to the Linux directory. All files are gone. In most cases, recovering deleted files is very dependant on if any of the space or directory structure has been reused. In this case, the space hasn't been reused, but I don't know if the deletion of 40 files, one at a time, would reuse the directory blocks or just mark them available. Before I go too far in this Am I just out of luck? Or is there a decent chance I can recover these files? Thanks Tom Duerbusch THD Consulting -- For LINUX-390 subscribe / signoff / archive access instructions, send email to lists...@vm.marist.edu with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 -- For more information on Linux on System z, visit http://wiki.linuxvm.org/ -- For LINUX-390 subscribe / signoff / archive access instructions, send email to lists...@vm.marist.edu with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 -- For more information on Linux on System z, visit http://wiki.linuxvm.org/
Undeleting files
Where I know the answer to this question, generally. I wonder if this can be done in a very defined sitituation. I have disk "/dev/dasdb1", formatted with ext3. There is one directory on it. That directory had about 40 files on it of a few megabytes each. This is SLES 10 SP 2. I connected to the Linux image with WINSCP. I bought up that directory in one pane and in the other pane, I bought up my thumb drive. I wanted to copy the files to my thumb drive. Instead of copying the files, I thought syncing the directories would be easier. Well, I synced an empty directory to the Linux directory. All files are gone. In most cases, recovering deleted files is very dependant on if any of the space or directory structure has been reused. In this case, the space hasn't been reused, but I don't know if the deletion of 40 files, one at a time, would reuse the directory blocks or just mark them available. Before I go too far in this Am I just out of luck? Or is there a decent chance I can recover these files? Thanks Tom Duerbusch THD Consulting -- For LINUX-390 subscribe / signoff / archive access instructions, send email to lists...@vm.marist.edu with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 -- For more information on Linux on System z, visit http://wiki.linuxvm.org/
