Post new topic   Reply to topic
View previous topic Printable version Log in to check your private messages View next topic
Author Message
someoneanywhereOffline
22 Post subject: Data Recovery??  PostPosted: 24.02.2012, 05:32



Joined: 2010-10-31
Posts: 49
Location: usa
Status: Offline
Hello.
I have need of guidance.
What happened:
While giving some ¨hands on¨ sys. admin. time to a friends son files were transferred from one partition to another using #:mc (midnight commander). They were initially copied over, verified by kdiff use. Then they were deleted from the original partition.
2 weeks later and numerous reboots, several dist-upgrades, that partition shows only /lost+found but is clearly has 15gib of space occupied.
My friends son says that he did not use #:mke2fs -j /dev/the partition. Instead he merely did #: mkdir /something; edited /etc/fstab to add the mount point; cd´d into it checked #:ls -l; then #:mc to copy directories and files in.

To be honest I had not had a reason to need to use any of the moved files until today.
My thinking is that because he saw #:sfdisk -l showed the partition to be labeled id: 83 Linux his assumption was that a filesystem was there.

So the up shot is that I do not know if the contents can be recovered. I surely do not want to issue the mke2fs -j before salvaging the data.
Anyway, is there any hope?
 
 View user's profile Send private message  
Reply with quote Back to top
someoneanywhereOffline
Post subject: RE: Data Recovery??  PostPosted: 24.02.2012, 06:44



Joined: 2010-10-31
Posts: 49
Location: usa
Status: Offline
Maybe something like this?
http://www.debian-administration.org/ar ... lash_cards
 
 View user's profile Send private message  
Reply with quote Back to top
hubiOffline
Post subject: RE: Data Recovery??  PostPosted: 24.02.2012, 12:25
Moderator


Joined: 2010-09-11
Posts: 228
Location: Vienna (AT)
Status: Offline
Could you list this mountpoint with
      Code:
ls -ali
?

hubi

_________________
Tilos Rádió Budapest
 
 View user's profile Send private message Send e-mail  
Reply with quote Back to top
x-un-i
Post subject: RE: Data Recovery??  PostPosted: 24.02.2012, 16:47
Team Member


Joined: 2010-08-26
Posts: 170

if you know the name of one file ( or part of it) you can try

locate <file_name>

peraphs is the file in some other (unexpected) place?

_________________
Why do strong arms fatigue themselves with frivolous dumbbells?
To dig a vineyard is worthier exercise for men.
Marcus Valerius Martialis, römischer Satiriker und Epigrammdichter

Será que o diabo perdeu a virgindade?
 
 View user's profile Send private message  
Reply with quote Back to top
someoneanywhereOffline
Post subject: Re: RE: Data Recovery??  PostPosted: 24.02.2012, 17:20



Joined: 2010-10-31
Posts: 49
Location: usa
Status: Offline
      hubi wrote:
Could you list this mountpoint with
      Code:
ls -ali
?

hubi


Output: as user: beaumarchais:
beaumarchais@Perseverance:/vault$ ls -ali
total 24
2 drwxr-xr-t 3 beaumarchais beaumarchais 4096 Jan 12 2010 .
2 drwxr-xr-x 30 root root 4096 Feb 22 06:04 ..
11 drwxr-xr-t 2 beaumarchais beaumarchais 16384 Jan 12 2010 lost+found
beaumarchais@Perseverance:/vault$
------------------------
Output: as root:
root@Perseverance:/vault# ls -ali
total 24
2 drwxr-xr-t 3 beaumarchais beaumarchais 4096 Jan 12 2010 .
2 drwxr-xr-x 30 root root 4096 Feb 22 06:04 ..
11 drwxr-xr-t 2 beaumarchais beaumarchais 16384 Jan 12 2010 lost+found
root@Perseverance:/vault#
-----------------------------------

I guess I´m confused what it tells me?
 
 View user's profile Send private message  
Reply with quote Back to top
someoneanywhereOffline
Post subject: Re: RE: Data Recovery??  PostPosted: 24.02.2012, 17:25



Joined: 2010-10-31
Posts: 49
Location: usa
Status: Offline
      x-un-i wrote:
if you know the name of one file ( or part of it) you can try

locate <file_name>

peraphs is the file in some other (unexpected) place?


Yes I tried that, no soap!!
 
 View user's profile Send private message  
Reply with quote Back to top
broweOffline
Post subject: RE: Data Recovery??  PostPosted: 24.02.2012, 19:39



Joined: 2010-09-12
Posts: 155
Location: Canada
Status: Offline
@someoneanywhere:

Perhaps the history command may help you figure out what commands were issued and that might help track down exactly what happened. Of course what happens within mc wouldn't be logged, but from what you stated, many of the commands were issued from the terminal.

In the future consider using a VM sandbox for educating a new sys admin. A live-cd and a blank hd is an even better way to learn.
 
 View user's profile Send private message  
Reply with quote Back to top
someoneanywhereOffline
Post subject: Re: RE: Data Recovery??  PostPosted: 24.02.2012, 21:21



Joined: 2010-10-31
Posts: 49
Location: usa
Status: Offline
      browe wrote:
@someoneanywhere:

Perhaps the history command may help you figure out what commands were issued and that might help track down exactly what happened. Of course what happens within mc wouldn't be logged, but from what you stated, many of the commands were issued from the terminal.

In the future consider using a VM sandbox for educating a new sys admin. A live-cd and a blank hd is an even better way to learn.


You could not be more correct!! Originally I was going to have him muck about on an unused machine that I´d plugged in an old sidux installation ..or latest aptosid Livedvd.. but No I had to get talked into giving him my machine!!!!!
Hammer blows to the head as it feels so fine when they stop, don´t you know. So now I suffer my own stupidity.

History confirms no mke2fs. He went straight to using mc after editing the /etc/fstab and mounting the partition.
 
 View user's profile Send private message  
Reply with quote Back to top
domiciusOffline
Post subject: RE: Re: RE: Data Recovery??  PostPosted: 24.02.2012, 23:31



Joined: 2010-09-13
Posts: 35
Location: Zagreb, Croatia
Status: Offline
If the partition hasn't been touched since then, you should be able to recover most of your files. I've done it myself a couple of years ago even though I don't remember a solution that will nicely restore everything including paths.

The link someoneanywhere posted above leads to a good start. testdisk is one and scalpel another tool that I know of (both in Debian repository).

But since it's been a long time that I've had to recover anything (and had to do it only ever once), I'm not that knowledgeable about the subject and there may be other solutions available but this is a good start.

_________________
domicius
 
 View user's profile Send private message Visit poster's website  
Reply with quote Back to top
WillamKOffline
Post subject: RE: Re: RE: Data Recovery??  PostPosted: 25.02.2012, 04:53



Joined: 2012-02-17
Posts: 12
Location: Miami
Status: Offline
I am new this Forum. This is very interting subject, i will also find some search for that, Hope fully i will get solution about the subject.
 
 View user's profile Send private message  
Reply with quote Back to top
someoneanywhereOffline
Post subject: Re: RE: Re: RE: Data Recovery??  PostPosted: 25.02.2012, 23:05



Joined: 2010-10-31
Posts: 49
Location: usa
Status: Offline
      domicius wrote:
If the partition hasn't been touched since then, you should be able to recover most of your files. I've done it myself a couple of years ago even though I don't remember a solution that will nicely restore everything including paths.

The link someoneanywhere posted above leads to a good start. testdisk is one and scalpel another tool that I know of (both in Debian repository).

But since it's been a long time that I've had to recover anything (and had to do it only ever once), I'm not that knowledgeable about the subject and there may be other solutions available but this is a good start.

I´ll root about and see what I can do with it. Yes, I am lucky in that nothing further has been done to the partition (well fsck´d once at boot up).
I have testdisk and scalpel.....so first we read documentation and snoop about for tutorials.
 
 View user's profile Send private message  
Reply with quote Back to top
domiciusOffline
Post subject: RE: Re: RE: Re: RE: Data Recovery??  PostPosted: 28.02.2012, 22:38



Joined: 2010-09-13
Posts: 35
Location: Zagreb, Croatia
Status: Offline
Lol, I realize only now it was you who posted that link. Smile

_________________
domicius
 
 View user's profile Send private message Visit poster's website  
Reply with quote Back to top
saxxonianOffline
Post subject: RE: Re: RE: Re: RE: Data Recovery??  PostPosted: 01.03.2012, 16:46



Joined: 2010-09-11
Posts: 28
Location: Brasov, Romania
Status: Offline
photorec used to work for me, not only on SDcards. not in the repos anymore?
 
 View user's profile Send private message  
Reply with quote Back to top
slhOffline
Post subject: RE: Re: RE: Re: RE: Data Recovery??  PostPosted: 01.03.2012, 17:21



Joined: 2010-08-25
Posts: 760

Status: Offline
photorec is part of the "testdisk" package.
 
 View user's profile Send private message  
Reply with quote Back to top
Display posts from previous:     
Jump to:  
All times are GMT - 12 Hours
Post new topic   Reply to topic
View previous topic Printable version Log in to check your private messages View next topic
Powered by Zafenio