PDA

View Full Version : Need Help Retrieving Deleted Files



fedorafan2
12th April 2007, 06:14 AM
I had posted about 2 days ago 366 pictures I took on my website /var/www/www.savagemania.com/public_html/az they are taking up a lot of space so I deleted them with winscp and then the directory. This was ok because I had them on my laptop. But my laptop has crashed and now all the pictures are wiped right off the laptop along with everything on the laptop. The server they were on is FC5. Is there any possable way to get the files back from deletion.

Wayne
12th April 2007, 06:16 AM
Would you like the bad news first?

Wayne

stevea
12th April 2007, 06:31 AM
This will be pretty ugly and I will strongly advise you to immediately stop using that drive, and only mount it read-only until you try the recovery. Here's a howto for ext2/3 (you can remount etx3's as etx2.
http://www.faqs.org/docs/Linux-mini/Ext2fs-Undeletion.html

Best of luck.

Wayne
12th April 2007, 06:33 AM
Yes, let us know how it goes in case it happens to someone else.

Wayne

contraculto
12th April 2007, 06:43 AM
sounds like trouble...

fedorafan2
12th April 2007, 11:16 PM
This will be pretty ugly and I will strongly advise you to immediately stop using that drive, and only mount it read-only until you try the recovery. Here's a howto for ext2/3 (you can remount etx3's as etx2.
http://www.faqs.org/docs/Linux-mini/Ext2fs-Undeletion.html

Best of luck.


I am going to try this but am a little lost. How can I find out what partitions I have on the disks and also how do I find which partition the files would be on so I can unmount it?

scott_g
13th April 2007, 01:01 AM
I know there's a way to list your partitions in the terminal, I just can't remember how (I seem to remember fdisk -l , but I'm not sure).

Edit: fdisk -l should work, but doesn't on my machine for some reason; /sbin/fdisk -l works for me instead.

also, /etc/fstab lists all the filesystems your machine mounts on boot, so you can trace the location where you had your pictures to the /dev/___ designation, hopefully.

If you like a graphical method, you can use gparted (use yum to install); it is similar to Partition Magic.

Scott

fedorafan2
13th April 2007, 03:31 AM
I know there's a way to list your partitions in the terminal, I just can't remember how (I seem to remember fdisk -l , but I'm not sure).

Edit: fdisk -l should work, but doesn't on my machine for some reason; /sbin/fdisk -l works for me instead.

also, /etc/fstab lists all the filesystems your machine mounts on boot, so you can trace the location where you had your pictures to the /dev/___ designation, hopefully.

If you like a graphical method, you can use gparted (use yum to install); it is similar to Partition Magic.

Scott

What does gdparted do?

scott_g
13th April 2007, 04:56 AM
What does gdparted do?

gparted is a tool that can be used to resize partitions, or make new partitions on your hard drive. I was suggesting you use it, as it lets you select different drives, and see how much space is being used by each partition, in bar-like graphs. I saw something similar to this displayed on windows (without the ability to edit partitions), under Computer Management/Disk Management.

Re-thinking the problem, it might be easier to use the system monitor (it can be added to a panel, like the top panel by right clicking in an empty space near the clock/applications menu in gnome, and clicking add to panel), as it will let you see logical volume partitions (fedora's default). Under resources, this lists the size of each mounted partition, where on your system it is mounted, and how full it is. Unfortunately, it can't write new partitions (which I don't think will affect your scenario).

Just a few questions:

Do you know where on your system the pictures were saved?

Did you set up your own partitions when you installed, or did you use the default layout?

Scott

fedorafan2
13th April 2007, 05:46 AM
gparted is a tool that can be used to resize partitions, or make new partitions on your hard drive. I was suggesting you use it, as it lets you select different drives, and see how much space is being used by each partition, in bar-like graphs. I saw something similar to this displayed on windows (without the ability to edit partitions), under Computer Management/Disk Management.

Re-thinking the problem, it might be easier to use the system monitor (it can be added to a panel, like the top panel by right clicking in an empty space near the clock/applications menu in gnome, and clicking add to panel), as it will let you see logical volume partitions (fedora's default). Under resources, this lists the size of each mounted partition, where on your system it is mounted, and how full it is. Unfortunately, it can't write new partitions (which I don't think will affect your scenario).

Just a few questions:

Do you know where on your system the pictures were saved?

Did you set up your own partitions when you installed, or did you use the default layout?

Scott

The files were at /var/www/savagemania.com/public_html/az/***file_name***
Yes I let the installer make the partitions for both hard drives.

stevea
13th April 2007, 06:18 AM
df will show you the mounted partititions.
[root@nidula ~]# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/hda1 24797380 16175780 7341624 69% /
tmpfs 386412 0 386412 0% /dev/shm
/dev/hda3 43698448 13336716 29029864 32% /home


Then, for example if it's in /home/fred you'll want to debugfs /dev/hda3 {{in my case}}
Probably your best bet to not lose the files is to boot a standalone CD and only mount the fs
Read-only until you try to recover.

LinuxManMikeC
13th April 2007, 08:06 AM
Sweet, basic data forensics, been wanting to learn how to do this with free software :D .

Jongi
13th April 2007, 08:34 AM
fedorafan2: I am guessing here that you have a swap partition and an LVM partition setup for the rest. Post the output of:

# su -
# fdisk -l
# cat /etc/fstab
# lvscan

scott_g: the reason why you have to use /sbin/fdisk -l is probably because you are trying to run fdisk as a normal user and the normal user does not have /sbin as part of its path.

fedorafan2
13th April 2007, 02:53 PM
Can I do those commands using live-cd knoppix or do I have to boot?

Jongi
13th April 2007, 03:09 PM
Does the knoppix live-cd come with LVM support? You will need that to run the lvscan.

You will need need to mount the partition with your fc6 to get the contents for /etc/fstab.

LinuxManMikeC
13th April 2007, 07:37 PM
Yep, Knoppix has LVM. Always been an excellent rescue disk for me. Has all the tools needed for the data recovery being discussed. Be kinda cool if they included the system-config-lvm tool though.

fedorafan2
20th April 2007, 12:48 AM
I shut down the server when I realized the files had been deleted and fschk or whatever it is called cleaned the disk at boot and erased all of them. But I did manage to get about 70 of them back from the cameria and I had taken some on a film cameria so it is ok.