recovering a deleted directory


 
Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users recovering a deleted directory
# 1  
Old 12-09-2010
recovering a deleted directory

I accidentally deleted a very important directory today with this rm -r. What would be the recommended way to recover my directory? After a lot of googleing I have seen these choices. Could I get some recommendations please?
Testdisk
Photorec- Doesn't recover file name like I would like.
debugfs- Can't get the syntax right. I have encrypted home directory.
Foremost
Scalpel
Magic Rescue
sleuthkit
# 2  
Old 12-09-2010
Quote:
Originally Posted by COKEDUDE
I accidentally deleted a very important directory today with this rm -r. What would be the recommended way to recover my directory?
First off, stop writing to your home folder, at all. Unmount it if you can. Every write could be overwriting files you want back.

What is your filesystem, anyway?
Quote:
After a lot of googleing I have seen these choices. Could I get some recommendations please?
Testdisk
Photorec- Doesn't recover file name like I would like.
Is files with no names better than no files at all? I don't know a tool that can put back "rm -rf" like it never was, you deleted them so take what you can get. Depending on file type, there may be metadata in the files that'd help name them anyway.
Quote:
I have encrypted home directory.
You'll need to decrypt it into a format that looks like a normal volume for nearly any tool to touch it.
Quote:
Magic Rescue
Much the same idea as photorec, but more powerful, capable of extracting more kinds of files. Also sloooooooooooooooow.

Last edited by Corona688; 12-09-2010 at 03:15 AM..
# 3  
Old 12-09-2010
Quote:
Originally Posted by Corona688
First off, stop writing to your home folder, at all. Unmount it if you can. Every write could be overwriting files you want back.

What is your filesystem, anyway? Is files with no names better than no files at all? I don't know a tool that can put back "rm -rf" like it never was, you deleted them so take what you can get. Depending on file type, there may be metadata in the files that'd help name them anyway. You'll need to decrypt it into a format that looks like a normal volume for nearly any tool to touch it. Much the same idea as photorec, but more powerful, capable of extracting more kinds of files. Also sloooooooooooooooow.
I've been using a live cd since I did it.
ext3

Quote:
You'll need to decrypt it into a format that looks like a normal volume for nearly any tool to touch it.
Any idea how? I have read every guide I can find on the internet with no luck.

What does Magic Rescue do that photorec can't do?
# 4  
Old 12-10-2010
Quote:
Originally Posted by COKEDUDE
Any idea how? I have read every guide I can find on the internet with no luck.
Well, how did you encrypt it in the first place? How does it usually get mounted?
Quote:
What does Magic Rescue do that photorec can't do?
Magic Rescue works much the same way as Photorec -- scan every block to see if it's the start of a file -- but it's lot more sophisticated, using script-like plugins to recognize many types of files instead of recognizing a simple few hardcoded ones.

Code:
$ ls /usr/share/magicrescue/recipes
avi  gimp-xcf  gzip       jpeg-jfif  mp3-id3v2  perl  zip
elf  gpl       jpeg-exif  mp3-id3v1  msoffice   png
$ cat /usr/share/magicrescue/recipes/jpeg-exif
# Extracts jpeg files with the Exif magic bytes. These usually originate from
# digital camaras or other devices.
# Depends on jpegtran from libjpeg: http://freshmeat.net/projects/libjpeg/
# See also jpeg-jfif
6 string Exif
0 int32 ffd80000 ffff0000
extension jpg
command jpegtran -copy all -outfile "$1"
$

This is also what makes it slower, since it does a lot more work on each block it reads, checking them all to see what they are.

You seem to be having lots and lots of data loss problems lately. A good backup might be an idea.
# 5  
Old 12-30-2010
Quote:
Originally Posted by Corona688
Well, how did you encrypt it in the first place? How does it usually get mounted? Magic Rescue works much the same way as Photorec -- scan every block to see if it's the start of a file -- but it's lot more sophisticated, using script-like plugins to recognize many types of files instead of recognizing a simple few hardcoded ones.

Code:
$ ls /usr/share/magicrescue/recipes
avi  gimp-xcf  gzip       jpeg-jfif  mp3-id3v2  perl  zip
elf  gpl       jpeg-exif  mp3-id3v1  msoffice   png
$ cat /usr/share/magicrescue/recipes/jpeg-exif
# Extracts jpeg files with the Exif magic bytes. These usually originate from
# digital camaras or other devices.
# Depends on jpegtran from libjpeg: http://freshmeat.net/projects/libjpeg/
# See also jpeg-jfif
6 string Exif
0 int32 ffd80000 ffff0000
extension jpg
command jpegtran -copy all -outfile "$1"
$

This is also what makes it slower, since it does a lot more work on each block it reads, checking them all to see what they are.

You seem to be having lots and lots of data loss problems lately. A good backup might be an idea.
Like this when I installed Linux.

Image

By logging in the normal way from the login menu. I don't think I should be using my system the normal way cause that will decrease the possibility of me getting my data back.

I wrote my own guide of how to decrypt an encrypted home directory. I wrote the Live CD method of opening a encrypted home directory.

https://help.ubuntu.com/community/En...me%20directory

The first time wasn't my fault. The second time I was stupid. I had a phone call while I was testing the rm -r command. I typed in the wrong directory while I was talking. I know I should have stopped what I was doing but I didn't.

Back the topic at hand. Should I use Magic Rescue or a different program?
# 6  
Old 12-30-2010
Why use only one program?

What program you use also depends on what kind of files you're trying to recover. photorec and magicrescue are best for images and media files.
# 7  
Old 12-30-2010
Quote:
Originally Posted by Corona688
Why use only one program?

What program you use also depends on what kind of files you're trying to recover. photorec and magicrescue are best for images and media files.
Good point. I am trying to recover several different types of text files like *.doc, *.rtf, and text files with no file extensions. Also a few picture files.
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Solaris

Directory cannot be deleted!!!

Friends, I have accidently, as root, created a directory gabsf under /home. Now I cannot delete this thing, I have tried rm and rmdir, as well as explicit path name, but it is really undeleteable. Here is what ls -l says. # ls -l /home total 6 drwxr-xr-x 2 dawood dawood 2 Sep 5... (3 Replies)
Discussion started by: gabam
3 Replies

2. Emergency UNIX and Linux Support

Directory got deleted

One of my directory code where i have stored all my scripts have disappeared . I have no idea on how it got deleted.Could someone pls help me to track-back on what would have happened? I left the office yesterday and today when i just logged in to work with the scripts I could not find the... (13 Replies)
Discussion started by: michaelrozar17
13 Replies

3. Shell Programming and Scripting

recovering cron job

I deleted one of the job from the cron tab. I want to get it back. How can i do this. pplease suggest me.. thanks (1 Reply)
Discussion started by: pranabrana
1 Replies

4. AIX

Recovering a failed system

Hi,My system is not booting and at the startup it is getting struck.In HMC error code is coming as 0000, I know the reason of failing.I have few queries on recovery, please answer:1. I have mksysb of the system from which I can restore the system but problem is my few application mount point was a... (5 Replies)
Discussion started by: aixpank
5 Replies

5. SCO

Recovering 5.0.7 from Bootable CD

I've been working with SCO Unix for several years now but have never had to restore a system from a bare drive. I have a bootable CD that contains what appears to be the correct files necessary to recover the boot and root filesystems. I've got the BIOS setup such that the CD is the first... (12 Replies)
Discussion started by: teamhog
12 Replies

6. Solaris

Directory should not be deleted, But the contents can be

Hi Guys, I have an user's home directory set to /home/A And A contains the following directories B & C Is there some way in solaris by which i can prevent the directories B and C from getting deleted by the user but the contents of the directories B & C can be deleted ? Also i have... (2 Replies)
Discussion started by: localhost
2 Replies

7. Shell Programming and Scripting

files of size 0 need to be deleted inside a directory

Hiiii, I have written a script which takes backup of some log files. let say the backuplocation is --- /abc/backuplocation -rw-r--r-- 1 webmut2 spgroup 0 Jan 27 02:41 ansrpt23994.log -rw-r--r-- 1 webmut2 spgroup 0 Jan 27 02:41 ansrpt3601.log -rw-r--r-- 1... (2 Replies)
Discussion started by: namishtiwari
2 Replies

8. Solaris

Deleted Lost+Found directory

If you delete your lost & found directory, how do you get it back, just do a mkdir? (1 Reply)
Discussion started by: BG_JrAdmin
1 Replies

9. SCO

HELP! Recovering system from New Orleans!!

I am helping a company recover a system that is SCO OS 5.0.5 - they have their backup media, cd copies of SCO, but they do not have their license keys to install and SCO is being difficult in validating their license. Does anyone have an install license key for 5.0.5 that they would be willing... (1 Reply)
Discussion started by: ggraham
1 Replies

10. UNIX for Dummies Questions & Answers

Recovering lost files

I noticed this in a search for more security tools... It IS possible to "undelete" a file; I suppose recover would be a better term for it. I suppose we've all made the boo-boo (that we all hopefully learned from) of deleting a file, and finding that you do not have a backup. I wouldn't... (1 Reply)
Discussion started by: LivinFree
1 Replies
Login or Register to Ask a Question