[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Recovering accidentally deleted file folder



On 16/10/2017 21:00, Deltonos wrote:
You can try withy any distro that contains Sleuthkit+Autopsy:
https://www.sleuthkit.org/autopsy/

My advise is, if you can, make and image using dd from afected machine to
external HD  and work from another dedicated system to recover it (or you
can use and live distro like this one http://www.deftlinux.net/download/)

Regards.

2017-10-16 10:23 GMT-05:00 Richard Owlett <rowlett@cloud85.net>:

It wasn't backed up - will have to follow advice  advice I've given others
;/
I've not done file recovery since early days of WinXP.

On the affected machine I'm running Stretch(9.1) with Mate desktop.
The affected folders are on a partition normally mounted by a line in
fstab.

I immediately shut down.
There is another instance of Debian on a separate partition.
Logging in as root I edited fstab commenting out the appropriate line.

I feel the the data is still valid - there is just no appropriate
directory entries for the affected folder and its sub-directories.

Guidance please.

TIA




Hi,
Image the partition or at least mount it ro, then depending on the file-system and the mime-type of the files you want to recover, you can try "extundelete" (ext3/4, man page is well documented), "photorec" (in package "testdisk", not limited to photo/image, provides step-by-step guidance). As mentioned above if the "easy" way don't work you can resort to proper forensic tools, but they often have a steep learning curve.

Good luck.


Reply to: