From owner-freebsd-questions@freebsd.org Tue May 17 09:25:04 2016 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id B6675B3DF33 for ; Tue, 17 May 2016 09:25:04 +0000 (UTC) (envelope-from freebsd@edvax.de) Received: from mx02.qsc.de (mx02.qsc.de [213.148.130.14]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 7F7091D3D for ; Tue, 17 May 2016 09:25:04 +0000 (UTC) (envelope-from freebsd@edvax.de) Received: from r56.edvax.de (port-92-195-20-216.dynamic.qsc.de [92.195.20.216]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx02.qsc.de (Postfix) with ESMTPS id 3916E24920; Tue, 17 May 2016 11:16:25 +0200 (CEST) Received: from r56.edvax.de (localhost [127.0.0.1]) by r56.edvax.de (8.14.5/8.14.5) with SMTP id u4H9GPoO002046; Tue, 17 May 2016 11:16:25 +0200 (CEST) (envelope-from freebsd@edvax.de) Date: Tue, 17 May 2016 11:16:25 +0200 From: Polytropon To: Shahin Hasanov Cc: FREEBSD_QUESTION Subject: Re: recover deleted files Message-Id: <20160517111625.414ff4f4.freebsd@edvax.de> In-Reply-To: References: Reply-To: Polytropon Organization: EDVAX X-Mailer: Sylpheed 3.1.1 (GTK+ 2.24.5; i386-portbld-freebsd8.2) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 May 2016 09:25:04 -0000 On Tue, 17 May 2016 09:51:18 +0500, Shahin Hasanov wrote: > Hi everybody! > rsync accidentally delete my files and directories. I knew the name all > deleted files, That doesn't help much, sorry. > Please tell me how I can recover my deleted files. You cannot. Restore from backup. In fact, you can, but you need to act quickly. Do not use the partition where your data has been located. Allow no further writes. Afterwards, make yourself familiar with recovery tools. Refer to the list archive and check out my older posts regarding this topic (keywords: UFS recovery, fat fingers, undelete). I lost lots of files, too - but I was able to recover them. Keep in mind that "there is an app for this" and "one app fits all needs" does not apply. I will provide my "famous list" of recovery tools as a starting point: OS tools: fetch -rR recoverdisk Ports collection: ddrescue dd_rescue <- use this to create images to work with magicrescue testdisk <- restores content recoverjpeg foremost photorec ffs2recov scan_ffs tsk <- The Sleuth Kit fls dls ils autopsy Proprietary (free test version for diagnostics): SysDev Laboratories LLC "UFS Explorer" You usually will need to understand what you're doing. Read "A Fast File System for UNIX" by M. K. McKusick. as a good introduction. It helped me a lot. http://pages.cs.wisc.edu/~dusseau/Classes/CS537-S01/ffs.pdf You will then understand why "easy undeleting" of files and directories is not possible by design. Blocks of deleted files are marked "free", and they are not connected to any inodes anymore. But as long as the blocks don't get overwritten, their content will be there. Probably TSK (The Sleuth Kit) is the way to go. In worst case, it can recover anything. But try the "easier tools" like photorec and magicrescue. What you need to do depends on the kind of files you want to recover. If you're searching for specific files, using "grep" on the disk device is possible as well; I once wrote an inefficient and stupid script for that task. Just make sure you do not cause any writes within the boundaries of the partition you want to rescue from. Write to another disk partition, disk, or USB media, or network. You can also make a copy of the whole partition and work with that (as a file). > mount > /dev/da1p1 (ufs, local, journaled soft-updates) Do not mount r/w where you want to recover from - the message is missing the "read-only" element. Any writes may destroy your data. Be very careful. Good luck. -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ...