Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #187922

Re: Recovering accidentally deleted file folder

Show all headers | View raw

On 16/10/2017 21:00, Deltonos wrote:
> You can try withy any distro that contains Sleuthkit+Autopsy:
> https://www.sleuthkit.org/autopsy/
> 
> My advise is, if you can, make and image using dd from afected machine to
> external HD  and work from another dedicated system to recover it (or you
> can use and live distro like this one http://www.deftlinux.net/download/)
> 
> Regards.
> 
> 2017-10-16 10:23 GMT-05:00 Richard Owlett <rowlett@cloud85.net>:
> 
>> It wasn't backed up - will have to follow advice  advice I've given others
>> ;/
>> I've not done file recovery since early days of WinXP.
>>
>> On the affected machine I'm running Stretch(9.1) with Mate desktop.
>> The affected folders are on a partition normally mounted by a line in
>> fstab.
>>
>> I immediately shut down.
>> There is another instance of Debian on a separate partition.
>> Logging in as root I edited fstab commenting out the appropriate line.
>>
>> I feel the the data is still valid - there is just no appropriate
>> directory entries for the affected folder and its sub-directories.
>>
>> Guidance please.
>>
>> TIA
>>
>>
> 

Hi,
Image the partition or at least mount it ro, then depending on the 
file-system and the mime-type of the files you want to recover, you can 
try "extundelete" (ext3/4, man page is well documented), "photorec" (in 
package "testdisk", not limited to photo/image, provides  step-by-step 
guidance). As mentioned above if the "easy" way don't work you can 
resort to proper forensic tools, but they often have a steep learning curve.

Good luck.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Recovering accidentally deleted file folder Richard Owlett <rowlett@cloud85.net> - 2017-10-16 17:30 +0200
  Re: Recovering accidentally deleted file folder Deltonos <deltonos77@gmail.com> - 2017-10-16 17:40 +0200
    Re: Recovering accidentally deleted file folder "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-16 17:50 +0200
      Re: Recovering accidentally deleted file folder solitone <solitone@mail.com> - 2017-10-17 14:10 +0200
  Re: Recovering accidentally deleted file folder Dejan Jocic <jodejka@gmail.com> - 2017-10-16 17:50 +0200
  Update - was {Re: Recovering accidentally deleted file folder} Richard Owlett <rowlett@cloud85.net> - 2017-10-18 18:10 +0200
    Re: Update - was {Re: Recovering accidentally deleted file folder} Richard Owlett <rowlett@cloud85.net> - 2017-10-18 21:20 +0200
      Re: Update - was {Re: Recovering accidentally deleted file folder} Richard Owlett <rowlett@cloud85.net> - 2017-10-20 14:40 +0200

csiph-web