Date: Thu, 28 Feb 2013 05:55:45 -0600 From: "Joseph A. Nagy, Jr" <jnagyjr1978@gmail.com> To: Polytropon <freebsd@edvax.de> Cc: "Questions @ FreeBSD" <questions@freebsd.org> Subject: Re: Fat Fingered An 'rm -rf' of Important Files Message-ID: <512F45C1.7090004@gmail.com> In-Reply-To: <20130228100211.17e2cb43.freebsd@edvax.de> References: <512ECA4A.3030202@gmail.com> <20130228100211.17e2cb43.freebsd@edvax.de>
next in thread | previous in thread | raw e-mail | index | archive | help
On 02/28/13 03:02, Polytropon wrote: > On Wed, 27 Feb 2013 21:08:58 -0600, Joseph A. Nagy, Jr wrote: >> Okay, I know I should pay more attention to what I'm doing, and having >> separate partitions isn't an excuse for regular backups. If we can skip >> the finger wagging on that part I'd appreciate it. > > I've experienced similar and different "moments of unintended > successful rm", so I won't mention missing backups. ;-) (: >> Is there any way to retrieve any of them? > > Yes, but it's not easy. Prepare to go on a journey though > file system documentation, trial & error. > > Obviously we're talking about a USB stick, so no TB amount > of data has to be processed. First of all: Do _not_ alter > the USB stick in any way. No matter what you do, it can > always get worse. Oh no, not a USB stick, I'm talking hdd partitions (4GiB on one, 64GiB on another) but it will be the same process. I'll see about investing in an external hard drive. >> I've not wrote any data to >> either partition since the accidental deletion. > > Very good. > > You can first make a copy of the file system (the whole > stick) and use that: It will be faster to access and if > you do something wrong, the original data (which we can > assume is still there) won't be affected: > > # dd if=/dev/da0 of=stick.dd > > Now let me introduce you to the "list of helpful programs > in case you've done something ultimately stupid" which I > have already repeated several times on this mailing list. > I'm sure you can find some program that will help you. > See my individual notes regarding your specific situation. > > I will "refactor" text from a previous message. > > A worst-case tool to recover data (not file names, but file > content) is testdisk; in ports: sysutils/testdisk. It's also > on some diagnostics and recovery CDs like UBCD. I've tried test disk but it doesn't have a UFS option for some reason. > You can also try this: > > # fetch -rR <device> where would I fetch to? > Also recoverdisk could be useful. also in /usr/ports/sysutils ? > The ports collection contains further programs that might be > worth investigating; just in case they haven't been mentioned > yet: > > ddrescue > dd_rescue <- use this to make an image of the stick! > magicrescue > testdisk <- restores content > recoverjpeg > foremost > photorec > > Then also > > ffs2recov > scan_ffs > > should be mentioned. > > And finally, the "cure to everything" is found in The Sleuth Kit > (in ports: tsk): > > fls > dls > ils > autopsy awesome > Keep in mind: Read the manpages before using the programs. It's > very important to do so. You need to know what you're dealing the testdisk man page is very unhelpful. ): > with, or you'll probably fail. There is no magical tetroplyrodon > to click ^Z and get everything back. :-) well, not so sure. Found a Windows program to recover deleted stuff on UFS, but I imagine it's harder touse then the above (and more expensive). I will definitely work on the above first. > Proprietary (and expensive) tools like "R-Studio" or "UFS Explorer" > can still be considered worth a try. Their trial versions are for > free. "UFS Explorer" even works using wine (I've tried it). I have a frustrating history with wine but will give it a go (also, amd64 here, so who knows). > Note: > > I've dealt with a comparable problem some months ago when > a "Windows" PC has "repaired" a FAT file system on a USB > stick, with the "excellent" result of all data being gone. > I could restore everything except the original file names > (which I wrote a script to "conclude" them from file metadata > and content). > > So it should be possible. > > > > > Good luck! Thanks a million, you've saved me a lot of money (hopefully!) -- Yours in Christ, Joseph A Nagy Jr "Whoever loves instruction loves knowledge, But he who hates correction is stupid." -- Proverbs 12:1 Emails are not formal business letters, whatever businesses may want. Original content CopyFree (F) under the OWL http://copyfree.org/licenses/owl/license.txt
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?512F45C1.7090004>