Re: Need help salvaging what I can from major disaster

From	Andrew McGlashan <andrew.mcglashan@affinityvision.com.au>
Newsgroups	linux.debian.user
Subject	Re: Need help salvaging what I can from major disaster
Date	2016-03-14 20:50 +0100
Message-ID	<rcGF4-8ey-3@gated-at.bofh.it> (permalink)
References	<rc1Vg-5VI-9@gated-at.bofh.it> <rc2HE-6xE-3@gated-at.bofh.it> <rcaOS-3OJ-3@gated-at.bofh.it> <rckXU-2dP-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On 14/03/2016 7:38 AM, Kynn Jones wrote:
> @Russ, @Pascal: thanks for your comments and suggestions.  They are
> very helpful.

A couple of things.

ext2 is virtually the same as ext3 and ext4, but the latter two have
journal logs.

Earlier today I was working on a script and I accidentally deleteed it,
brought it back with this tool [1].

I wonder if you could re-align your original partition and then try to
do recovery of that?  There won't be any journal to help though, so the
tool I used isn't going to help; but there might be other options to
reconstruct the file system from super blocks that haven't been trashed.

Cheers
AndrewM

[1]  http://extundelete.sourceforge.net/

# aptitude show extundelete
Monday 14 March 22:32:14 AEDT 2016 -- show extundelete
Package: extundelete
State: installed
Automatically installed: no
Version: 0.2.0-2.1
Priority: optional
Section: utils
Maintainer: Debian Forensics <forensics-devel@lists.alioth.debian.org>
Architecture: amd64
Uncompressed Size: 157 k
Depends: e2fslibs (>= 1.42), libc6 (>= 2.2.5), libcomerr2 (>= 1.01),
libgcc1 (>= 1:4.1.1), libstdc++6 (>= 4.6)
Description: utility to recover deleted files from ext3/ext4 partition
 extundelete uses the information stored in the partition's journal to
attempt to recover a file that has been deleted. There is no guarantee
that any particular file will be able to be undeleted.
Homepage: http://extundelete.sourceforge.net/

# umount /home/andrewm/other
# extundelete --restore-file install-wrk/veracrypt/1.17/get-files.sh
/dev/mapper/n4800eco--a----vg1-home--andrewm--other
# mount /home/andrewm/other

# find /root/RECOVERED_FILES/
/root/RECOVERED_FILES/
/root/RECOVERED_FILES/install-wrk
/root/RECOVERED_FILES/install-wrk/veracrypt
/root/RECOVERED_FILES/install-wrk/veracrypt/1.17
/root/RECOVERED_FILES/install-wrk/veracrypt/1.17/get-files.sh

# cp -p RECOVERED_FILES/install-wrk/veracrypt/1.17/get-files.sh
/home/andrewm/other/install-wrk/veracrypt/1.17/

Thread

Need help salvaging what I can from major disaster Kynn Jones <kynnjo@gmail.com> - 2016-03-13 01:20 +0100
  Re: Need help salvaging what I can from major disaster Kynn Jones <kynnjo@gmail.com> - 2016-03-13 02:10 +0100
    Re: Need help salvaging what I can from major disaster Kynn Jones <kynnjo@gmail.com> - 2016-03-13 05:00 +0100
      Re: Need help salvaging what I can from major disaster rlharris@oplink.net - 2016-03-13 06:00 +0100
    Re: Need help salvaging what I can from major disaster Pascal Hambourg <pascal@plouf.fr.eu.org> - 2016-03-13 10:50 +0100
      Re: Need help salvaging what I can from major disaster Kynn Jones <kynnjo@gmail.com> - 2016-03-13 21:40 +0100
        Re: Need help salvaging what I can from major disaster Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2016-03-14 20:50 +0100
          Re: Need help salvaging what I can from major disaster Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2016-03-14 21:00 +0100
          Re: Need help salvaging what I can from major disaster Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2016-03-14 21:00 +0100

csiph-web