Re: file recovery - urgent
Am Mittwoch 14 Februar 2007 schrieb Micha:
> Hello,
>
> Please excuse this is not strictly debian or laptop related,
> but i'm in urgent trouble.
> I accidently deleted a folder with 3500 files on my laptop,
> just when i wanted to do a really overdue backup.
> It's about 5 GB, nearly 3 months of work, and the last
> backup is a month ago where most of the stuff was added
> just recently, including hundreds of hours of the working time.
>
> When i realized what happened i shutdown the laptop.
> The files are in the user's home on the root filesystem,
> a journaling ext3. debian sid.
> I was so shocked i didn't look for the exact time, but i
> think i could boil it down to a 10 minute time frame.
> I've no experience with file recovery.
> I would be able to boot into a cd or dvd which i could
> download and burn on another machine.
> I'm aware a time based recovery could mean i'd have to reinstall
> the KDE session and do more cleanup afterward, but that's
> absolutely unimportant, if i only could recover the files.
> It would be worth a complete reinstall.
>
> Any good idea what i can do ?
Hallo Micha!
BIG DISCLAIMER first: Try at your own risk. I have no practical experience
with these tools...
... but they might just do what you want so it might be worth a try:
martin@shambala:~> apt-cache search ext3 undelete
e2undel - Undelete utility for the ext2 file system
recover - Undelete files on ext2 partitions
(search http://packages.debian.org)
Cauion: They do not work with ext3 only with ext2 as their package
descriptions claim! I do not know whether it might be enough to remove
the journal via tune2fs, but AFAIK then ext3 should behave just like
ext2.
Important: I recommend to make a block based copy of the partition with
via ddrescue or dd, for example FIRST! So you have a second chance if
anything goes wrong at your first attempt.
ddrescue /dev/hda2 hda2.img
(store hda2.img on some external harddrive, replace /dev/hda2 with your
partition device file)
You could then work with the image file only not altering whats on the
harddisk until you are confident that it works! Use somehting
like "mkdir /mnt/recover ; mount -o loop -t ext2 hda2.img /mnt/recover".
(or even better make another copy of the file first;-)
You should do everything with a Live CD. I recommend one of these (I am
not sure whether they have e2undel or recover pre-installed, but if
anything else fails you could install it yourself, I think on recent
Knoppix this even works via aptitude otherwise you might have to compile
the tool):
- GRML: http://grml.org (text mode based, as limited GUI support)
- Knoppix: http://www.knoppix.org (has full GUI support)
Maybe someone who has experience recovering deleted files from ext2/ext3
filesystem can give you better hints. This is all untried and untested!
Regards,
--
Martin 'Helios' Steigerwald - http://www.Lichtvoll.de
GPG: 03B0 0D6C 0040 0710 4AFA B82F 991B EAAC A599 84C7
Reply to: