Re: Where did my files go?

On Thu, 09 Mar 2006 08:06:48 +0100
"Rolf Karlsson" <rolfkarlsson82@xxxxxxxxxxx> wrote:

> I have a really big problem. Here's the deal.
> 
> I mounted an ext3 partition on my system, I tried using the -o uid=myuid
> but since that didn't work I figured that it probably would work anyway
> to write to it without being root.
> 
> Now to my little problem: I tried MOVING all my files to this mounted 
> partition through emelfm2, of course not being root then. It reports the 
> following:
> 
> Cannot create new directory /mnt/Download/My Documents - Access denied
> 
> Okey, so I can't move it, no biggie. Yes it is, because even though the 
> program couldn't actually WRITE the target it removed the source. PLEASE 
> tell me there's a way to get my loved files back!

Probably. But it's tedious.

From your message I infer that the old partition was not ext3 (as I recall, 
there is no undelete for ext3 partitions).

If it is ext2, then www.billjonas.com/papers/undeletion.html presents the 
following:

Unmount (or remount as read-only) the partition (we'll call it $oops) where the 
deleted files are located: 
# umount $oops
or
# mount -o remount,ro $oops 
Get a listing of all inodes which have been deleted (make sure the output goes 
someplace safe): 
# echo lsdel | debugfs $oops > $lsdel.out 
Edit the file so that it has only the inodes that you want it to recover (you 
should be able to tell which ones these are from the time stamp, as well as the 
fact that they'll probably be toward the end and there'll be a bunch of them 
with the same timestamp). 
Get a couple more useful files: 
# awk '{print $1}' $lsdel.out > $inodes
# sed 's/.*/stat <&>/' inodes |debugfs $oops > $stats 
Perform the actual undeletion: 
# for i in $(cat $inodes); do echo "dump <$i> -p $safeplace/recovered.$i" 
|debugfs $oops; done

At this point, it's "just" a matter of finding out what all the files are and 
renaming them. Assuming that you actually recovered them. 

Note: 
$oops is the partition that once housed the now-deleted files 
$lsdel.out is a filname that you should specify 
$inodes is a filname that you should specify 
$stats is a filname that you should specify 
$safeplace is a path to some directory that is not on the same partition as the 
deleted files. 
If you have a lot of data to recover, it might be best to do it in batches. For 
example, I was doing this once on a list of over 1500 inodes, and the data was 
going to be too big to fit in a free partition, so I made several files of the 
form inodes.01, inodes.02, and so forth, each containing a list of 100 unique 
inodes.

If it is reiser, 
www.antrix.net/journal/techtalk/reiserfs_data_recovery_howto.comments presents 
this:

Once you realize that you've lost data, don't do anything else on that 
partition - you may cause that data to be overwritten by new data.
Unmount that partition. e.g., umount /home
Find out what actual device this partition refers to. You can usually get this 
information from the file /etc/fstab. We'll assume here that the device is 
/dev/hda3.

Run the command: reiserfsck --rebuild-tree -S -l /root/recovery.log /dev/hda3

You need to be root to do this. Read the reiserfsck man page for what these 
options do and for more options. Some interesting options are '--rebuild-sb, 
--check'

After the command finishes, which might be a long time for a big partition, you 
can take a look at the logfile /root/recovery.log if you wish.
Mount your partition: mount /home
Look for the lost+found directory in the root of the partition. Here, that 
would be: /home/lost+found
This directory contains all the files that could be recovered. Unfortunately, 
the filenames are not preserved for a lot of files. You'll find some 
sub-directories - filenames within those are preserved!
Look through the files and copy back what you need.

Finally, I must apologise for the situation you're in. I think I can see what 
went wrong, and will rush a fix for that.

Regards
Tom


--
Users can unsubscribe from the list by sending email to 
emelfm2-request@xxxxxxxxxxxxx with 'unsubscribe' in the subject field or by 
logging into the web interface.

Other related posts: