Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #187920 > unrolled thread
| Started by | Richard Owlett <rowlett@cloud85.net> |
|---|---|
| First post | 2017-10-16 17:30 +0200 |
| Last post | 2017-10-20 14:40 +0200 |
| Articles | 8 — 5 participants |
Back to article view | Back to linux.debian.user
Recovering accidentally deleted file folder Richard Owlett <rowlett@cloud85.net> - 2017-10-16 17:30 +0200
Re: Recovering accidentally deleted file folder Deltonos <deltonos77@gmail.com> - 2017-10-16 17:40 +0200
Re: Recovering accidentally deleted file folder "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-16 17:50 +0200
Re: Recovering accidentally deleted file folder solitone <solitone@mail.com> - 2017-10-17 14:10 +0200
Re: Recovering accidentally deleted file folder Dejan Jocic <jodejka@gmail.com> - 2017-10-16 17:50 +0200
Update - was {Re: Recovering accidentally deleted file folder} Richard Owlett <rowlett@cloud85.net> - 2017-10-18 18:10 +0200
Re: Update - was {Re: Recovering accidentally deleted file folder} Richard Owlett <rowlett@cloud85.net> - 2017-10-18 21:20 +0200
Re: Update - was {Re: Recovering accidentally deleted file folder} Richard Owlett <rowlett@cloud85.net> - 2017-10-20 14:40 +0200
| From | Richard Owlett <rowlett@cloud85.net> |
|---|---|
| Date | 2017-10-16 17:30 +0200 |
| Subject | Recovering accidentally deleted file folder |
| Message-ID | <uBfv4-5zb-11@gated-at.bofh.it> |
It wasn't backed up - will have to follow advice advice I've given others ;/ I've not done file recovery since early days of WinXP. On the affected machine I'm running Stretch(9.1) with Mate desktop. The affected folders are on a partition normally mounted by a line in fstab. I immediately shut down. There is another instance of Debian on a separate partition. Logging in as root I edited fstab commenting out the appropriate line. I feel the the data is still valid - there is just no appropriate directory entries for the affected folder and its sub-directories. Guidance please. TIA
[toc] | [next] | [standalone]
| From | Deltonos <deltonos77@gmail.com> |
|---|---|
| Date | 2017-10-16 17:40 +0200 |
| Message-ID | <uBfEL-5CC-35@gated-at.bofh.it> |
| In reply to | #187920 |
[Multipart message — attachments visible in raw view] — view raw
You can try withy any distro that contains Sleuthkit+Autopsy: https://www.sleuthkit.org/autopsy/ My advise is, if you can, make and image using dd from afected machine to external HD and work from another dedicated system to recover it (or you can use and live distro like this one http://www.deftlinux.net/download/) Regards. 2017-10-16 10:23 GMT-05:00 Richard Owlett <rowlett@cloud85.net>: > It wasn't backed up - will have to follow advice advice I've given others > ;/ > I've not done file recovery since early days of WinXP. > > On the affected machine I'm running Stretch(9.1) with Mate desktop. > The affected folders are on a partition normally mounted by a line in > fstab. > > I immediately shut down. > There is another instance of Debian on a separate partition. > Logging in as root I edited fstab commenting out the appropriate line. > > I feel the the data is still valid - there is just no appropriate > directory entries for the affected folder and its sub-directories. > > Guidance please. > > TIA > >
[toc] | [prev] | [next] | [standalone]
| From | "tv.debian@googlemail.com" <tv.debian@googlemail.com> |
|---|---|
| Date | 2017-10-16 17:50 +0200 |
| Message-ID | <uBfOp-5GB-3@gated-at.bofh.it> |
| In reply to | #187921 |
On 16/10/2017 21:00, Deltonos wrote: > You can try withy any distro that contains Sleuthkit+Autopsy: > https://www.sleuthkit.org/autopsy/ > > My advise is, if you can, make and image using dd from afected machine to > external HD and work from another dedicated system to recover it (or you > can use and live distro like this one http://www.deftlinux.net/download/) > > Regards. > > 2017-10-16 10:23 GMT-05:00 Richard Owlett <rowlett@cloud85.net>: > >> It wasn't backed up - will have to follow advice advice I've given others >> ;/ >> I've not done file recovery since early days of WinXP. >> >> On the affected machine I'm running Stretch(9.1) with Mate desktop. >> The affected folders are on a partition normally mounted by a line in >> fstab. >> >> I immediately shut down. >> There is another instance of Debian on a separate partition. >> Logging in as root I edited fstab commenting out the appropriate line. >> >> I feel the the data is still valid - there is just no appropriate >> directory entries for the affected folder and its sub-directories. >> >> Guidance please. >> >> TIA >> >> > Hi, Image the partition or at least mount it ro, then depending on the file-system and the mime-type of the files you want to recover, you can try "extundelete" (ext3/4, man page is well documented), "photorec" (in package "testdisk", not limited to photo/image, provides step-by-step guidance). As mentioned above if the "easy" way don't work you can resort to proper forensic tools, but they often have a steep learning curve. Good luck.
[toc] | [prev] | [next] | [standalone]
| From | solitone <solitone@mail.com> |
|---|---|
| Date | 2017-10-17 14:10 +0200 |
| Message-ID | <uByR4-1ZX-27@gated-at.bofh.it> |
| In reply to | #187922 |
On 16/10/17 17:43, tv.debian@googlemail.com wrote: > package "testdisk" Testdisk worked beautifully well for me
[toc] | [prev] | [next] | [standalone]
| From | Dejan Jocic <jodejka@gmail.com> |
|---|---|
| Date | 2017-10-16 17:50 +0200 |
| Message-ID | <uBfOp-5GB-9@gated-at.bofh.it> |
| In reply to | #187920 |
On 16-10-17, Richard Owlett wrote: > It wasn't backed up - will have to follow advice advice I've given others > ;/ > I've not done file recovery since early days of WinXP. > > On the affected machine I'm running Stretch(9.1) with Mate desktop. > The affected folders are on a partition normally mounted by a line in fstab. > > I immediately shut down. > There is another instance of Debian on a separate partition. > Logging in as root I edited fstab commenting out the appropriate line. > > I feel the the data is still valid - there is just no appropriate directory > entries for the affected folder and its sub-directories. > > Guidance please. > > TIA > You can use scalpel, or foremost. Both work fine, both are packaged in Debian. You can use them both on hard drives/partitions and on imaged files.
[toc] | [prev] | [next] | [standalone]
| From | Richard Owlett <rowlett@cloud85.net> |
|---|---|
| Date | 2017-10-18 18:10 +0200 |
| Subject | Update - was {Re: Recovering accidentally deleted file folder} |
| Message-ID | <uBZ4S-3kn-13@gated-at.bofh.it> |
| In reply to | #187920 |
I had posted: > It wasn't backed up - will have to follow advice advice I've given > others ;/ > > I've not done file recovery since early days of WinXP. > > On the affected machine I'm running Stretch(9.1) with Mate desktop. > > The affected folders are on a partition normally mounted by a line > in fstab. > > > I immediately shut down. > There is another instance of Debian on a separate partition. > > Logging in as root I edited fstab commenting out the appropriate line. > > > I feel the the data is still valid - there is just no appropriate > directory entries for the affected folder and its sub-directories. > > I have copied the partition to another partition (using dd). The critical data in the deleted folder(s) was my SeaMonkey profile. I discovered I did have a several months old backup of the profile. I am now running Squeeze (9.1) from a fresh install and installed the latest SeaMonkey on it. Several packages in the Debian repository have been suggested. I will download their man-pages and will try them. Several forensic packages have also been suggested which will used if required. Thanks for the help.
[toc] | [prev] | [next] | [standalone]
| From | Richard Owlett <rowlett@cloud85.net> |
|---|---|
| Date | 2017-10-18 21:20 +0200 |
| Subject | Re: Update - was {Re: Recovering accidentally deleted file folder} |
| Message-ID | <uC22J-58h-3@gated-at.bofh.it> |
| In reply to | #188019 |
On 10/18/2017 11:04 AM, Richard Owlett wrote: > I had posted: > >> It wasn't backed up - will have to follow advice advice I've given >> others ;/ >> >> I've not done file recovery since early days of WinXP. >> >> On the affected machine I'm running Stretch(9.1) with Mate desktop. >> >> The affected folders are on a partition normally mounted by a line >> in fstab. >> >> >> I immediately shut down. >> There is another instance of Debian on a separate partition. >> >> Logging in as root I edited fstab commenting out the appropriate line. >> >> >> I feel the the data is still valid - there is just no appropriate >> directory entries for the affected folder and its sub-directories. >> >> > > I have copied the partition to another partition (using dd). > The critical data in the deleted folder(s) was my SeaMonkey profile. > I discovered I did have a several months old backup of the profile. > I am now running Squeeze (9.1) from a fresh install and installed the > latest SeaMonkey on it. > > Several packages in the Debian repository have been suggested. I will > download their man-pages and will try them. > > Several forensic packages have also been suggested which will used if > required. > > Thanks for the help. I did "extundelete --restore-all /dev/sdaNN". It apparently worked while stating it could not restore several files. SeaMonkey was unhappy with the results -- giving an error message suggestive of permission problem(s). That is still progress, before SeaMonkey would not start. I'll have to take a break and work out a reasonable diagnostic routine. Thanks again.
[toc] | [prev] | [next] | [standalone]
| From | Richard Owlett <rowlett@cloud85.net> |
|---|---|
| Date | 2017-10-20 14:40 +0200 |
| Subject | Re: Update - was {Re: Recovering accidentally deleted file folder} |
| Message-ID | <uCEKK-3Lg-5@gated-at.bofh.it> |
| In reply to | #188031 |
On 10/18/2017 02:09 PM, Richard Owlett wrote: > On 10/18/2017 11:04 AM, Richard Owlett wrote: >> I had posted: >> >>> It wasn't backed up - will have to follow advice advice I've given >>> others ;/ >>> >>> I've not done file recovery since early days of WinXP. >>> >>> On the affected machine I'm running Stretch(9.1) with Mate desktop. >>> >>> The affected folders are on a partition normally mounted by a line >>> in fstab. >>> >>> >>> I immediately shut down. >>> There is another instance of Debian on a separate partition. >>> >>> Logging in as root I edited fstab commenting out the appropriate line. >>> >>> >>> I feel the the data is still valid - there is just no appropriate >>> directory entries for the affected folder and its sub-directories. >>> >>> >> >> I have copied the partition to another partition (using dd). >> The critical data in the deleted folder(s) was my SeaMonkey profile. >> I discovered I did have a several months old backup of the profile. >> I am now running Squeeze (9.1) from a fresh install and installed the >> latest SeaMonkey on it. >> >> Several packages in the Debian repository have been suggested. I will >> download their man-pages and will try them. >> >> Several forensic packages have also been suggested which will used if >> required. >> >> Thanks for the help. > > I did "extundelete --restore-all /dev/sdaNN". > It apparently worked while stating it could not restore several files. > SeaMonkey was unhappy with the results -- giving an error message > suggestive of permission problem(s). > That is still progress, before SeaMonkey would not start. > I'll have to take a break and work out a reasonable diagnostic routine. > Thanks again. > Having enough space on my HDD I added a fresh install of Stretch with a fresh copy of SeaMonkey. I then copied the critical SeaMonkey profile from the restored image to folder with profiles on new the new install and added it to profiles.ini . SeaMonkey had no problem with it.
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.user
csiph-web