If not at all possible with public tools, is it possible for experts to recover the files? (as in pay someone to do it), What happened is I accidentally deleted a few folders containing family photos and my text files for work, address books etc, just personal stuff I don't have backups of. (from a ext4 partition 'root')
Feel free to call me stupid, but I didn't notice I had deleted them before I did the following... I ended up copying enough data to the ext4 partition which completely filled it (less than 1mb remained), once I backed those up I deleted them (trash empty) a few days later I ran sfill to erase the originals.
I removed some games, and was going to remove the .desktop files, but I accidentally typed "rm /usr/share/applications/*" instead of "rm /usr/share/applications/Games/*". if I could "undelete" and recover these files. The only other way I can think of to get them back is to reinstall all of the programs. I'm using Slackware 13 and have an ext4 file system if that helps.
My laptop has two os. one is windows vista. and other is Ubuntu. I am currently on ubuntu system, this is my primary OS.There are 4 partitions of my hard diskWindows OSLinux(Ubuntu OSData Now the problem part. The data partition is NTFS. I have mounted this partition on the location /media/windrive-a under ubuntu OS.A little while back i decided to delete the mounting of the data partition and i fired command rm -r /media/windrive-a/. To give me a shock; all my data on data drive is gone.Now, I know this is not the command to remove mounted partition. But I have committed the wrong. Is there any way i can get my data back. These are very important data for me.
Deleted a whole bunch of files, I have backed it up but it was from about 2 weeks ago and as I had added loads of stuff in the meantime I urgently need to recover the files.Ubuntu 9.10. Any and every file recovery program you know please.Preferably one that allows me to recover an entire directory, not just individual files, but it'll be fine if that is it.
Yesterday I accidentaly deleted all files from my desktop (with rm). Now I am looking for way how to recover them.
I tried to use scalpel to recover them which found many files (more than 800000 zip files). I stopped the process cause It would take ages. I would like to recover files only from desktop folder. Is this possible?
I moved a few files from a directory in my home directory structure to the KDE trash folder, and then deleted them from the trash folder. About a minute later I regretted this, and now I'd like to see if there's any way to recover the files. First, are there any good utilities for restoring accidentally deleted files? If so, where would I look for these files? Does the KDE trash config file actually correspond to a physical directory somewhere, or do the files just remain hidden in their original location?
I wiped out 60% of my VirtualBox .vdi files on one of my partions. The file sizes ranged from 3gb to 9gb files. (I did have some backups but 4 months ago). Needless to say I'll be backing my files up more often (especially my Virtual Image .vdi files). So here are the steps...: [ Look, I know it seems like allot of steps, but its worth it in the end!!]
(By the way, these are all ext3 filesystems, I would imagine you could recover fat32 [windows} type filesystems too, but I just did this under Linux filesystems) 1--> If you've found yourself deleted any files, try to unmount the partition. ( In my case it was an external 2 1/2 hard drive, command used to unmount is sudo umount /dev/sda3)
1b--> If you only have one partition, then I'd suggest shutting down your computer and putting a Live CD in it (preferably the Ubuntu Live CD).
2--> Whether 1 or 1b applies to you, install ext3grep from Synaptic or any package manager. (if you had to reboot via a live CD, make sure you unmount the partition that has the deleted files.(example umount /dev/sda1 or in my case it was umount /dev/sda3). If you're on the LiveCD of Ubuntu, I believe it will let you install the ext3grep package using Synaptic Package manager and it will put it in RAM under the Live Desktop Session.
3--> Now here's the important part before you proceed any further. If the partition that has the deleted files is taking up 30gb (yes 30gb used space), then you have to mount an existing partition GREATER than 30gb ***FREE*** SPACE. I happened to have another partition /media/sda7 already mounted that had 50 gb free.
So at this point, you must go to any directory under your (recovery partition, i'm referring to my 50gb partition /media/sda7). To do this, run the command cd /media/sda7, now you're in your (recovery partition). You can make a new directory if you want, or just use any existing directory on the /media/sda7 partition. (I made a directory something like mkdir ./Yikes ) So I get into the directory by cd /media/sda7/Yikes then run the following command....:
ext3grep --restore-all /dev/sda3
4--> ***Keep in mind, you just ran that command from the /media/sda7/Yikes directory on your recovery partition. ***This will create a folder called "RESTORED_FILES" under/in the Yikes Directory.*** The ext3grep command you just submitted will try to recover every single file on that partition that has the deleted files (i.e. /dev/sda3). There is a way to restore single files and their paths, but I got frustrated and just did a full restore.
5--> Depending on the partition size and number of files, it could take 30 minutes to 2 hours or more before you start to see messages in the terminal screen saying "Restored file... Abc.txt or sam.jpg". Let it finish!!! At first you will see it saying "Group 1, Group 2 and crazy characters going across the screen, that's normal." You know it's begining the actual restore process when you start to see "Restored file...".
6--> At this point you can open a DIFFERENT terminal screen and do cd /media/sda7/Yikes/RESTORED_FILES to see the files being restored under the various directories. This does work because I was able to restore at least 25gb worth of files. Again, file sizes ranged from 3gb to 9gb!!
7--> Final step when the 1st terminal screen is done restoring the files, you can either open them up from the /media/sda7/Yikes/RESTORED_FILES directory to check them out, or you can copy them back to where they were deleted before. BUT I WOULD SAY TO MAKE A BACKUP OF THE RESTORED FILES, or keep the restored files in the /media/sda7 partition.
-->Again, I did a "ext3grep --restore-all /dev/sda3" command from the partition that had plenty of free space (i.e. 50gb) to restore the 30 gb worth of deleted files (and that ext3grep --restore-all /dev/sda3 command was run in the following directory /media/sda7/Yikes ).
-->Remember to unmount the /dev/sda3 partition (i.e. the partition that has the deleted files). DO NOT MOUNT /devs/sda3 when running the ext3grep --restore-all command. The ext3grep documentation states you don't want to write anything to that partition because you run the risk of writing over files or directories that could be recovered.
-->This ext3grep utility saved me Big Time!! 4 to 5 months of work restored because of this utility. You can get it from Synaptic Package Manger searching for ext3grep.
I just downloaded, burned, and tried the ISO image. only to find out it's not a bootable, live CD, but rather a Windows program, ie. it requires booting into Windows and running it from the CD, which is not a good idea since the first thing to do in this case is to quit the OS to prevent it from using those newly available sectors to write new data. can a Linux-based live CD try and recover files recently deleted in an NTFS partition?
I am using CentOS 5.5.I suppose this is an oft repeated question. I accidentally deleted, using rm command, 2 wmv files. The files were in a single ext3 1Tb drive, with just 1 partition --- the ext3 one. Each file is 600 - 800mb. The 1Tb drive has only about 20Gb data.Immediately after deleting the files i unmounted the drive (/dev/sdc1). Thereafter i searched the the net and came to know of the recovery tools foremost and photorec. I have installed both of them. I am currently running both of them as root --- foremost is just showing a lot of * signs on the terminal and photorec has managed to find some txt and png files --- but no wmv.For foremost i used: /usr/sbin/foremost -t wmv -i /dev/sdc1For photorec i followed some instructions available on the web.
In the meantime, based on some post on the net i ran debugfs as root, then cd into the directory where the files were deleted. Then on typing ls -d i managed to get the inodes of the 2 deleted files and the names of the deleted files are also correct. The instructions on the net http://www.theavidcoder.com/?p=3 tell me to run fsstat and dls both of which i am unable to find in /bin, /usr/bin, /usr/sbin and /sbin. So i am unable to proceed further.
I cannot boot into by Ubuntu 9.1 machine.... Trying either GUI or rescue mode gives me the following error messages (which i copied by hand since they were in cli)
Code: mount : mounting /dev/disk/by-uuid/64e5cb0d-058a-4a4c-af4b-7afb6427a72e3 on root failed : invalid argument
mount : mounting /sys on /root/sys failed : no such file or directory mount : mounting /dev on /root/dev failed : no such file or directory mount : mounting /proc on /root/proc failed : no such file or directory
Target doesnt have /sbin/init The only thing i remember doing before this is deleting some bootloader files... but they were on another disk so I didn't think that it would affect my ubuntu install. Guess I was wrong how I can recover my system?
I've been trying to discover how can I recover data from a hard drive that as been previously configured with LVM, although not encrypted,but I have been having mixed results. I've been using LVM more and more lately to configure hard drives and my greatest fear is to have a motherboard fail on me and get locked out of the contents.
Say I have a file that's downloading (from a source that's hard to re-download from), but accidentally deleted from the filesystem namespace (/tmp/blah), and I'd like to recover this file. Normally I could just cp /proc/$PID/fd/$FD /tmp/blah, but in this case that would only get me a partial snapshot, since the file is still downloading. Furthermore, once the download completes, the downloading process (e.g. Chrome) will close the FD. Any way to recover by inode/create a hard link? Any other solutions? If it makes any difference, I'm mainly concerned with ext4.
I was installing windows vista on my computer, so I backed up everything to a external drive which was formatted with ext2. I then proceeded to install windows vista. When I got to the partition section I tried installing windows vista to my raid 0. When it didn't work I decided that I would delete all my existing partitions and create a new one. Well in my haste I accidentally deleted my ext2 partition from my backup drive that was still connected. As soon as I realized what I had done I shutdown the windows install and disconnected my external drive. This is the current state of my drive from parted:
Model: WD 15EADS External (scsi) Disk /dev/sdb: 1500GB Sector size (logical/physical): 512B/512B Partition Table: msdos Number Start End Size Type File system Flags
I know that the drive only had one partition before and that it took up the entire disk and it was ext2 (maybe ext3).
recover deleted files using "debugfs" & "extundelete" by running:Code:sudo debugfs /dev/sda3 and find inode number of deleted file using "ls -d" command and then running:Code:sudo extundelete /dev/sda3 --restore-file <inode#>but when my desired file was in a deleted folder I can't find my desired file inode number using debugfs
I'm running Mac OS X 10.5.8. I was recently uninstalling mysql5 from /opt/local/bin.I typed:rm -rf /opt/local/bin mysql*instead ofrm -rf /opt/local/bin/mysql*This deleted my entire /opt/local/bin directory which puts me in a bit of a bind.Is there any way to recover those files? If not, I have a friend that is using a similar set of programs, would it be possible to use the contents of his folderIf I end up needing to reinstall everything in this folder, what is the best way to go about doing this?
I have accidentally ended up in deleting my root directory while I blindly fired command while watching movie.
I fired following command #rm -rf ~/<SPACE>*.out instead of this command #rm -rf ~/*.out
Things already done: 1) Created /root directory relogged to get some of basic settings of gnome and Desktop. 2) Things went well now when I login my desktop ,gnome environment and other things looks to be working well only prompt on my terminal has changed. I can fix it any ways.
Things I want to ask: 1) I haven't studied much about contents of /root directory to best of my knowledge is it like other user's home directory with some basic configuration files for mostly required applications. SO my question is have I lost any thing important system file or something? 2) If I have lost any important configuration or system data how can I recover it without reinstalling whole system? (My opinion about this is, It is quite possible but to do so, as far as I know capabilities of linux. But I still want comments from experts before I try any things on it because I don't want to backup my whole HDD and reinstall the whole stuff again for me and also my sister's stuff in MS.)
I have just had to reinstall my OS (Sabayon) onto a new and larger hard drive (dying old disk). I quickly saved all my old docs in /home on an external USB drive (formatted and then created an ext4 file system) before the swap and installation.
After getting the new disk running I connected the USB external disk. First I could not access the drive at all, but that seems to be fixed. Now I want to bring all my files back to my new /home folder but apparently they (especially the former MS Office .doc, .xls, etc files, not so much the OpenOffice files) are �read only� and I don't have permissions anymore. I am able to create directories on the external, and can move files back and forth, but don't seem to own many of them.Sabayon automatically mounted my external disk in /media/disk, rather than /mnt, so I've left that alone for now. After searching here and elsewhere for info, I tried a few things (below): For access I added a line to /etc/fstab:
/dev/sdb1 /media/disk ext4 noauto,rw 0 0
Here's what I've done to try and fix ownership already:
in /media I:
# chmod 775 disk
which gives output of:
media # ls -l total 4 drwxrwxr-x 2 root root 4096 Nov 1 21:30 disk
I'm not sure what the �total 4� refers to since there is only the one directory �disk� inside /media but I assume that's not part of this issue... Does adding umask=0 have anything to do with this, and if so where does that go?