From owner-freebsd-questions@FreeBSD.ORG Thu Feb 28 09:02:10 2013 Return-Path: Delivered-To: questions@freebsd.org Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id A7BAFEC0 for ; Thu, 28 Feb 2013 09:02:10 +0000 (UTC) (envelope-from freebsd@edvax.de) Received: from mx02.qsc.de (mx02.qsc.de [213.148.130.14]) by mx1.freebsd.org (Postfix) with ESMTP id 5287415DC for ; Thu, 28 Feb 2013 09:02:09 +0000 (UTC) Received: from r56.edvax.de (port-92-195-109-47.dynamic.qsc.de [92.195.109.47]) by mx02.qsc.de (Postfix) with ESMTP id 521D927783; Thu, 28 Feb 2013 10:02:07 +0100 (CET) Received: from r56.edvax.de (localhost [127.0.0.1]) by r56.edvax.de (8.14.5/8.14.5) with SMTP id r1S92BEd002703; Thu, 28 Feb 2013 10:02:11 +0100 (CET) (envelope-from freebsd@edvax.de) Date: Thu, 28 Feb 2013 10:02:11 +0100 From: Polytropon To: "Joseph A. Nagy, Jr" Subject: Re: Fat Fingered An 'rm -rf' of Important Files Message-Id: <20130228100211.17e2cb43.freebsd@edvax.de> In-Reply-To: <512ECA4A.3030202@gmail.com> References: <512ECA4A.3030202@gmail.com> Organization: EDVAX X-Mailer: Sylpheed 3.1.1 (GTK+ 2.24.5; i386-portbld-freebsd8.2) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Cc: "Questions @ FreeBSD" X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list Reply-To: Polytropon List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Feb 2013 09:02:10 -0000 On Wed, 27 Feb 2013 21:08:58 -0600, Joseph A. Nagy, Jr wrote: > Okay, I know I should pay more attention to what I'm doing, and having > separate partitions isn't an excuse for regular backups. If we can skip > the finger wagging on that part I'd appreciate it. I've experienced similar and different "moments of unintended successful rm", so I won't mention missing backups. ;-) > Is there any way to retrieve any of them? Yes, but it's not easy. Prepare to go on a journey though file system documentation, trial & error. Obviously we're talking about a USB stick, so no TB amount of data has to be processed. First of all: Do _not_ alter the USB stick in any way. No matter what you do, it can always get worse. > I've not wrote any data to > either partition since the accidental deletion. Very good. You can first make a copy of the file system (the whole stick) and use that: It will be faster to access and if you do something wrong, the original data (which we can assume is still there) won't be affected: # dd if=/dev/da0 of=stick.dd Now let me introduce you to the "list of helpful programs in case you've done something ultimately stupid" which I have already repeated several times on this mailing list. I'm sure you can find some program that will help you. See my individual notes regarding your specific situation. I will "refactor" text from a previous message. A worst-case tool to recover data (not file names, but file content) is testdisk; in ports: sysutils/testdisk. It's also on some diagnostics and recovery CDs like UBCD. You can also try this: # fetch -rR Also recoverdisk could be useful. The ports collection contains further programs that might be worth investigating; just in case they haven't been mentioned yet: ddrescue dd_rescue <- use this to make an image of the stick! magicrescue testdisk <- restores content recoverjpeg foremost photorec Then also ffs2recov scan_ffs should be mentioned. And finally, the "cure to everything" is found in The Sleuth Kit (in ports: tsk): fls dls ils autopsy Keep in mind: Read the manpages before using the programs. It's very important to do so. You need to know what you're dealing with, or you'll probably fail. There is no magical tetroplyrodon to click ^Z and get everything back. :-) Proprietary (and expensive) tools like "R-Studio" or "UFS Explorer" can still be considered worth a try. Their trial versions are for free. "UFS Explorer" even works using wine (I've tried it). Note: I've dealt with a comparable problem some months ago when a "Windows" PC has "repaired" a FAT file system on a USB stick, with the "excellent" result of all data being gone. I could restore everything except the original file names (which I wrote a script to "conclude" them from file metadata and content). So it should be possible. Good luck! -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ...