Re: file recovery - urgent
on the MLUG web site, i did an article on how I recovered a lot of files from
a damaged hard drive. It is a rather laborous way of doing things but it
works great. The post is here:
http://www.maysville-linux-users-group.org/ftopict-147.html
Another option that is much simpler that will work not included above is if
you can boot a live linux cd (recommended ones below) and create an image of
the partition that holds the /home directory to an external usb device or a
different hard drive (needs to be ext2 or ext3 if the partition is greater
than 2gb. I will use hda1 as the example below for the partition containing
the /home partition and a usb drive mounted on sda1:
# first create the mountpoint in the live cd for the usb drive
mkdir /mnt/usbdrive
# mount the usb drive
mount -t ext2 /dev/sda1 /mnt/usbdrive
# create the image using dd (make sure you substitute the correct partition):
dd if=/dev/hda1 of=/mnt/usbdrive/hda1.img
Now, with that image, you can use any live cd that has autopsy and sleuthkit
installed on it and run autoposy on the image and recover the files that
appear as deleted.
Recommended live cds with autopsy include backtrack security or the FCCU
Forensic Live CD:
http://www.remote-exploit.org/backtrack.html
or
http://http://www.lnx4n6.be
On Wednesday 14 February 2007 02:11:02 pm Micha wrote:
> Hello,
>
> Please excuse this is not strictly debian or laptop related,
> but i'm in urgent trouble.
> I accidently deleted a folder with 3500 files on my laptop,
> just when i wanted to do a really overdue backup.
> It's about 5 GB, nearly 3 months of work, and the last
> backup is a month ago where most of the stuff was added
> just recently, including hundreds of hours of the working time.
>
> When i realized what happened i shutdown the laptop.
> The files are in the user's home on the root filesystem,
> a journaling ext3. debian sid.
> I was so shocked i didn't look for the exact time, but i
> think i could boil it down to a 10 minute time frame.
> I've no experience with file recovery.
> I would be able to boot into a cd or dvd which i could
> download and burn on another machine.
> I'm aware a time based recovery could mean i'd have to reinstall
> the KDE session and do more cleanup afterward, but that's
> absolutely unimportant, if i only could recover the files.
> It would be worth a complete reinstall.
>
> Any good idea what i can do ?
>
> micha
>
> ps. And no, nothing in the trash folder, it was a real delete.
> pps. And yes, i will never again be lazy with backups.
>
>
>
>
> --
> To UNSUBSCRIBE, email to debian-laptop-REQUEST@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact
> listmaster@lists.debian.org
--
Ed Wiget
"Keeping Your Data Safe"
RHP Studios - http://www.rhpstudios.com
Personal Blog - http://www.edwiget.name
Xtreme Web Hosts - http://www.xtremewebhosts.com
MLUG - http://www.maysville-linux-users-group.org
MySpace - http://www.myspace.com/ewiget_tsp
Cell - 606-407-1838
Yahoo - ewiget41056
ICQ - 41515372
MSN - ewiget@rhpstudios.com
Jabber - ewiget41056@admin-networks.org
Skype - ewiget41056
IRC - tSp (#gentoo)
Reply to: