Red Hat

Hi,

I am working Linux server machine. Somebody by mistake(or may be knowingly) deleted few folders and files from the machine. How is this possible to recover those files and folders????

I normally logged in through Putty and winscp only. And don't have any history for putty sessions. So there is high probability that it is deleted from winscp session only.

Please help

Thanks

By restoring from backups...

Hi Vbe,

Thanks for your reply. But no backup for those files.....

Someone desperately deleting those files.
and one more thing is we are sharing same user name for different teams. and don't have root access also.

So at least, how can i find who has deleted those files..?

Tried with history. didn't worked...

Thanks for your help..
pamu

There are some tools to recover deleted files, but they are filesystem specific, e.g. FAT32, ext2, etc. Unfortunately, without root, you almost certainly cannot use these tools; they require raw access to the disk/partition device, which is seldom granted to unprivileged users.

If such a tool exists for your filesystem and if you are able to attain root, you should unmount that filesystem immediately. Once the data is overwritten with another file, your chances of recovery are practically zero.

Regards,
Alister

Are you sure they have been removed in the first place?
They could have been moved... or more vicious: renamed...
You should find something in the history files but that means looking at ( and have to be root...) all the users that connected since the last you knew the files present... (In older days I used to crash the system, use fsck, and reboot -n...)

Hi vbe,

Yes i am sure somebody from other team has deleted those files and folders.
I may have asked this question of the moving or renaming files but there are 4-5 main directory, lot of sub-directory and each having many files. and this happened second time in today itself. So i am sure about the files are not moved.
Yes. I don't have root access and the same others also don't have so there is very little chance that root user can delete this. That's why i checked only history for our common user.
But as per my knowledge there is high probability that they have deleted all the files from the winscp. So that's the problem.

thanks,
pamu

Without root, you can't do anything.

With root, the chances are unlikely since the system has been operating a long time since the files were deleted.