[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: file recovery - urgent

on the MLUG web site, i did an article on how I recovered a lot of files from 
a damaged hard drive.  It is a rather laborous way of doing things but it 
works great.  The post is here:


Another option that is much simpler that will work not included above is if 
you can boot a live linux cd (recommended ones below) and create an image of 
the partition that holds the /home directory to an external usb device or a 
different hard drive (needs to be ext2 or ext3 if the partition is greater 
than 2gb.  I will use hda1 as the example below for the partition containing 
the /home partition and a usb drive mounted on sda1:

# first create the mountpoint in the live cd for the usb drive
mkdir /mnt/usbdrive

# mount the usb drive
mount -t ext2 /dev/sda1 /mnt/usbdrive

# create the image using dd (make sure you substitute the correct partition):
dd if=/dev/hda1 of=/mnt/usbdrive/hda1.img

Now, with that image, you can use any live cd that has autopsy and sleuthkit 
installed on it and run autoposy on the image and recover the files that 
appear as deleted.

Recommended live cds with autopsy include backtrack security or the FCCU 
Forensic Live CD:

On Wednesday 14 February 2007 02:11:02 pm Micha wrote:
> Hello,
> Please excuse this is not strictly debian or laptop related,
> but i'm in urgent trouble.
> I accidently deleted a folder with 3500 files on my laptop,
> just when i wanted to do a really overdue backup.
> It's about 5 GB, nearly 3 months of work, and the last
> backup is a month ago where most of the stuff was added
> just recently, including hundreds of hours of the working time.
> When i realized what happened i shutdown the laptop.
> The files are in the user's home on the root filesystem,
> a journaling ext3. debian sid.
> I was so shocked i didn't look for the exact time, but i
> think i could boil it down to a 10 minute time frame.
> I've no experience with file recovery.
> I would be able to boot into a cd or dvd which i could
> download and burn on another machine.
> I'm aware a time based recovery could mean i'd have to reinstall
> the KDE session and do more cleanup afterward, but that's
> absolutely unimportant, if i only could recover the files.
> It would be worth a complete reinstall.
> Any good idea what i can do ?
> micha
> ps. And no, nothing in the trash folder, it was a real delete.
> pps. And yes, i will never again be lazy with backups.
> --
> To UNSUBSCRIBE, email to debian-laptop-REQUEST@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact
> listmaster@lists.debian.org

Ed Wiget
"Keeping Your Data Safe"
RHP Studios - http://www.rhpstudios.com
Personal Blog - http://www.edwiget.name
Xtreme Web Hosts - http://www.xtremewebhosts.com
MLUG - http://www.maysville-linux-users-group.org
MySpace - http://www.myspace.com/ewiget_tsp
Cell - 606-407-1838
Yahoo - ewiget41056
ICQ - 41515372
MSN - ewiget@rhpstudios.com
Jabber - ewiget41056@admin-networks.org
Skype - ewiget41056
IRC - tSp (#gentoo)

Reply to: