Re: Extundelete

[<tomas@tuxteam.de>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, Feb 16, 2016 at 08:49:33AM -0500, Susan Cragin wrote:
> Fooling around, lost "susan" folder. Want folder back. May have recursively deleted everything in it. Want txt org and a couple other extensions.
> (I've got days-old backup but want to try recovering files.)
> So, extundelete or something else?
> or
> Which Linux-on-a-stick has the best recovery tools?

I assume you haven't touched the file system very much after delete.
Otherwise... you might be out of luck anyway.

(1) Boot your machine *without mounting the file system in question*.
  If you have only this file system it means boot from some rescue
  disk, stick or whatever (I think most of them are good)

(2) Localize the disk partition in which your file system resides
  (let's call it /dev/sda1). Insert a stick or external disk big
  enough to hold this partition. Copy it (block-for-block), either

    dd if=/dev/sda1 of=/dev/your/copy

  if you dump to a device, or

    dd if=/dev/sda1 of=/mnt/filename

  if you dump to a file

The earlier you do those two steps the better. Now you can leisurely
trawl trough your copy (if you are extra careful you'll make a second
copy of that and keep that out of reach of children).

There are many programs around to try to make sense of the data in
your disk copy (magicrescue is available as a Debian package), but
there others might chime in.

But the above two steps are important as first steps: every time
your OS wants to allocate a bit of space in the file system, a little
piece of one of your deleted files dies.

Regards & good luck
- -- t
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlbDPTYACgkQBcgs9XrR2kbclACeKcePLWWx5ZqFDw2LwQ9w7suJ
MmkAnjS2jc7kM44IF9aed2X2guY08hP6
=Ls6j
-----END PGP SIGNATURE-----