From owner-freebsd-questions@FreeBSD.ORG Fri Jan 9 00:35:42 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 54DCF10656C4; Fri, 9 Jan 2009 00:35:42 +0000 (UTC) (envelope-from prvs=julian=25380973a@elischer.org) Received: from smtp-outbound.ironport.com (smtp-outbound.ironport.com [63.251.108.112]) by mx1.freebsd.org (Postfix) with ESMTP id 3E7268FC18; Fri, 9 Jan 2009 00:35:42 +0000 (UTC) (envelope-from prvs=julian=25380973a@elischer.org) Received: from unknown (HELO julian-mac.elischer.org) ([10.251.60.63]) by smtp-outbound.ironport.com with ESMTP; 08 Jan 2009 16:07:06 -0800 Message-ID: <49669529.4010501@elischer.org> Date: Thu, 08 Jan 2009 16:07:05 -0800 From: Julian Elischer User-Agent: Thunderbird 2.0.0.19 (Macintosh/20081209) MIME-Version: 1.0 To: Polytropon References: <20090109002846.c67d962f.freebsd@edvax.de> In-Reply-To: <20090109002846.c67d962f.freebsd@edvax.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: FreeBSD FS , FreeBSD Questions Subject: Re: Restore deleted files X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Jan 2009 00:35:43 -0000 Polytropon wrote: > Hi, > > I'd like to ask a two-stage question: > > 1. Is it possible to recover files that have been deleted? > > 2. Which tools or procedures are suggested for recovery? > > While sorting out some files and transfering them to another > hard disk, I accidentally deleted too much: the directory with > my videos taken by a digital camera. They were located in a > directory within a subtree, and I deleted the whole subtree > without first copying these files. > > I used the Midnight Commander to do this. As I read from its > source code, it seems to use the unlink() call to delete the > subtree recursively. Pressing PF8 can really ruin your day... > > Just after I noticed what I had done I unmounted the file system, > powered off the machine and put the disk on the shelf (it's still > there), no further write accesses. unmounting could have made things worse :-/ it then actually cleaned up and wrote the changes.... the best would have been to ahve hit and dropped into the debugger and then unplugged the drive.. still you MIGHT be lucky if the files are contiguous on disk (which images are likely to be. I don't know hte tools bu there are some... they are usually more useful for recovering from crashes etc. the trouble with accidental deletes is that they often leave no information as to what went where. hopefully someone else can give you more info as to tools. > > I would be glad if someone could enlighten me if there is any > chance to get the files back, even with the loss of the file > names (doesn't matter), and which tools seem to serve best in > this difficult task. > > And if it's impossible, please tell me. I can newfs the disk > then and free it, along with my mind. > > > > > PS. > I'm posting this question to -fs, too. Answers from this list > please keep me in CC because I'm not subscribed to -fs. Thank you! >