Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Hi there,
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest

recovering deleted files

  • 11-09-2007 1:57pm
    #1
    rymus
    Registered Users, Registered Users 2 Posts: 8,819 ✭✭✭


    I've got a redhat 9 installation that very stupidly I deleted a whole load of user data from. The server was taken down immediately after the accident and I've since had it running as a slave drive on my pc, scanning it with various 'undelete' tools and whatnot.

    Does anyone know a good way of getting deleted data back? I must have tried about 5/6 various bits of software at this stage. One or two of them show me the deleted files & folders but can't restore them as they appear with a 0 bytes size. Any ideas? Cheers!


Comments

  • #2
    Khannie
    Registered Users, Registered Users 2 Posts: 37,485 ✭✭✭✭Khannie


    What filesystem is the data on?


  • #3
    rymus
    Registered Users, Registered Users 2 Posts: 8,819 ✭✭✭rymus


    ext3


  • #4
    Khannie
    Registered Users, Registered Users 2 Posts: 37,485 ✭✭✭✭Khannie


    Pretty sure it's near to impossible to recover (with any ease) from ext3. :( I've tried myself before.

    Edit: I mean...the data's still on the drive, it's just not referenced in any way, so you could trawl the individual sectors looking to pull important information out of it.

    And...of course....I may be talking through my hole. :)


  • #5
    rymus
    Registered Users, Registered Users 2 Posts: 8,819 ✭✭✭rymus


    craptacular... better start job hunting :(

    Cheers Khannie.


  • #6
    pid()
    Closed Accounts Posts: 669 ✭✭✭pid()


    Did you back anything up on any tape drives or something similar?


  • Advertisement
  • #7
    rymus
    Registered Users, Registered Users 2 Posts: 8,819 ✭✭✭rymus


    god no, that'd be far too sensible. If it was my server I would have a tape backup, but alas the owner of this one had different ideas.


  • #8
    pid()
    Closed Accounts Posts: 669 ✭✭✭pid()


    Ouch. :eek:


  • #9
    leeroybrown
    Closed Accounts Posts: 7,563 ✭✭✭leeroybrown


    As pointed out above undelete and ext3 don't go together. In order to ensure that an ext3 journal can be replayed safely the block pointers in the inodes are zero'ed when files are deleted. Otherwise it would be possible for an ext3 journal replay to scrub re-allocated blocks.


  • #10
    ressem
    Registered Users, Registered Users 2 Posts: 2,426 ✭✭✭ressem


    What type of data?
    Was it a samba shared directory used for the usual windows files?

    http://foremost.sourceforge.net/foremost.html
    is meant to be ok at reconstituting some of the common binary formats.


  • #11
    NutJob
    Closed Accounts Posts: 884 ✭✭✭NutJob


    Again depending on data
    http://www.cgsecurity.org/wiki/PhotoRec

    foremost has a file to allow custom headers and footers if you don't mind a ton of work


  • Advertisement
  • #12
    rymus
    Registered Users, Registered Users 2 Posts: 8,819 ✭✭✭rymus


    data was all text files... various scripts and the odd tarball and zip file. I don't think I'm going to bother with the hassle of trying to recover it. Cheers all!


Advertisement