From owner-freebsd-questions@FreeBSD.ORG Thu Feb 28 11:55:49 2013 Return-Path: Delivered-To: questions@freebsd.org Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id DE2B1413 for ; Thu, 28 Feb 2013 11:55:49 +0000 (UTC) (envelope-from jnagyjr1978@gmail.com) Received: from mail-gg0-x22b.google.com (mail-gg0-x22b.google.com [IPv6:2607:f8b0:4002:c02::22b]) by mx1.freebsd.org (Postfix) with ESMTP id 9B9491DAD for ; Thu, 28 Feb 2013 11:55:49 +0000 (UTC) Received: by mail-gg0-f171.google.com with SMTP id j1so225638ggn.2 for ; Thu, 28 Feb 2013 03:55:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:message-id:date:from:user-agent:mime-version:to:cc :subject:references:in-reply-to:content-type :content-transfer-encoding; bh=YmzRVENTyh4Lly26WzNTw9VwJ8Kw3zw1Qe1rEdEXYfE=; b=Ervr6jRZ4NE37e+wPwqiXlF2ScJioMyC+2GGUa1wqAzdHN4BpT4VbVcU0LFXqayzsp 3FkTFNxSr81V7Mas1su+eXO5QKx/G/OQKExOsBBjCYx4qtgnC3tV2fcMO4/LRTNrhAqr UzeK0wM2Kkm0OO2V+lpnBGvbf85gZQ1JMzuOPPZeuloiiVrnfXlYPx3VsFmsFCmVABZT m7M5O7lucMohtCoqv3nq4jVV/qL8gDWNNcK5VmuVRm+ZFpO38zaw+TQDk3p4nQC7gwm/ b1UFTCoAVsZp8hQairdVtpBBOP4Ni7lJR3CnmUwzi8HSVrMRm3znTegsup0mwP4UQ4YC leHg== X-Received: by 10.236.76.135 with SMTP id b7mr4394326yhe.38.1362052549215; Thu, 28 Feb 2013 03:55:49 -0800 (PST) Received: from [192.168.1.33] (vid-196.dhcp.grp10.tnmmrl.infoave.net. [204.116.254.196]) by mx.google.com with ESMTPS id b62sm12809356yhf.13.2013.02.28.03.55.47 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Thu, 28 Feb 2013 03:55:48 -0800 (PST) Message-ID: <512F45C1.7090004@gmail.com> Date: Thu, 28 Feb 2013 05:55:45 -0600 From: "Joseph A. Nagy, Jr" User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:17.0) Gecko/20130221 Thunderbird/17.0.3 MIME-Version: 1.0 To: Polytropon Subject: Re: Fat Fingered An 'rm -rf' of Important Files References: <512ECA4A.3030202@gmail.com> <20130228100211.17e2cb43.freebsd@edvax.de> In-Reply-To: <20130228100211.17e2cb43.freebsd@edvax.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: "Questions @ FreeBSD" X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Feb 2013 11:55:49 -0000 On 02/28/13 03:02, Polytropon wrote: > On Wed, 27 Feb 2013 21:08:58 -0600, Joseph A. Nagy, Jr wrote: >> Okay, I know I should pay more attention to what I'm doing, and having >> separate partitions isn't an excuse for regular backups. If we can skip >> the finger wagging on that part I'd appreciate it. > > I've experienced similar and different "moments of unintended > successful rm", so I won't mention missing backups. ;-) (: >> Is there any way to retrieve any of them? > > Yes, but it's not easy. Prepare to go on a journey though > file system documentation, trial & error. > > Obviously we're talking about a USB stick, so no TB amount > of data has to be processed. First of all: Do _not_ alter > the USB stick in any way. No matter what you do, it can > always get worse. Oh no, not a USB stick, I'm talking hdd partitions (4GiB on one, 64GiB on another) but it will be the same process. I'll see about investing in an external hard drive. >> I've not wrote any data to >> either partition since the accidental deletion. > > Very good. > > You can first make a copy of the file system (the whole > stick) and use that: It will be faster to access and if > you do something wrong, the original data (which we can > assume is still there) won't be affected: > > # dd if=/dev/da0 of=stick.dd > > Now let me introduce you to the "list of helpful programs > in case you've done something ultimately stupid" which I > have already repeated several times on this mailing list. > I'm sure you can find some program that will help you. > See my individual notes regarding your specific situation. > > I will "refactor" text from a previous message. > > A worst-case tool to recover data (not file names, but file > content) is testdisk; in ports: sysutils/testdisk. It's also > on some diagnostics and recovery CDs like UBCD. I've tried test disk but it doesn't have a UFS option for some reason. > You can also try this: > > # fetch -rR where would I fetch to? > Also recoverdisk could be useful. also in /usr/ports/sysutils ? > The ports collection contains further programs that might be > worth investigating; just in case they haven't been mentioned > yet: > > ddrescue > dd_rescue <- use this to make an image of the stick! > magicrescue > testdisk <- restores content > recoverjpeg > foremost > photorec > > Then also > > ffs2recov > scan_ffs > > should be mentioned. > > And finally, the "cure to everything" is found in The Sleuth Kit > (in ports: tsk): > > fls > dls > ils > autopsy awesome > Keep in mind: Read the manpages before using the programs. It's > very important to do so. You need to know what you're dealing the testdisk man page is very unhelpful. ): > with, or you'll probably fail. There is no magical tetroplyrodon > to click ^Z and get everything back. :-) well, not so sure. Found a Windows program to recover deleted stuff on UFS, but I imagine it's harder touse then the above (and more expensive). I will definitely work on the above first. > Proprietary (and expensive) tools like "R-Studio" or "UFS Explorer" > can still be considered worth a try. Their trial versions are for > free. "UFS Explorer" even works using wine (I've tried it). I have a frustrating history with wine but will give it a go (also, amd64 here, so who knows). > Note: > > I've dealt with a comparable problem some months ago when > a "Windows" PC has "repaired" a FAT file system on a USB > stick, with the "excellent" result of all data being gone. > I could restore everything except the original file names > (which I wrote a script to "conclude" them from file metadata > and content). > > So it should be possible. > > > > > Good luck! Thanks a million, you've saved me a lot of money (hopefully!) -- Yours in Christ, Joseph A Nagy Jr "Whoever loves instruction loves knowledge, But he who hates correction is stupid." -- Proverbs 12:1 Emails are not formal business letters, whatever businesses may want. Original content CopyFree (F) under the OWL http://copyfree.org/licenses/owl/license.txt