Date: Sat, 16 Apr 2022 09:44:43 -0300 From: Alexandre Biancalana <biancalana@gmail.com> To: Sami Halabi <sodynet1@gmail.com> Cc: FreeBSD Current <freebsd-current@freebsd.org>, Matthias Apitz <guru@unixarea.de>, grembo@freebsd.org Subject: Re: recover deleted file Message-ID: <CAGF-nS7s24yn0fCyuZbdAMjuc_5KVrYFbpKNpKzhdqRnZdK-BQ@mail.gmail.com> In-Reply-To: <CAEW%2BogbUa0z0vXEDKQSmUZDHwNg6y6e9x8QNnu1i61MW_0kmKQ@mail.gmail.com> References: <CAEW%2BogZq0L_EUKFLpMhfMQASbk2o4vDmk3caBkZba=sYdw9qBg@mail.gmail.com> <70EA83C9-61AE-4256-9FF4-458197BA261D@freebsd.org> <CAEW%2BogbUa0z0vXEDKQSmUZDHwNg6y6e9x8QNnu1i61MW_0kmKQ@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--000000000000cf5d9a05dcc4e425 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sat, 16 Apr 2022 at 09:33 Sami Halabi <sodynet1@gmail.com> wrote: > how to do step 3 /? > > On Sat, Apr 16, 2022 at 2:59 PM Michael Gmelin <grembo@freebsd.org> wrote= : > >> Depends on the kind of file. >> >> You can always: >> 1. reboot the system into single user mode, mount the fs readonly >> (important to not overwrite data you want to recover) >> 2. dd the partition and into a file >> 3. find the content of the deleted file in the dump >> >> I was able to recover a complete codebase i deleted accidentally that wa= y >> a long time ago. >> >> Good luck >> Michael >> >> On 16. Apr 2022, at 13:52, Sami Halabi <sodynet1@gmail.com> wrote: >> >> =EF=BB=BF >> well.. thats the trivial answer.. the problem is backups is a day >> before... if i can undelete it would save me loss of 1 day offset.. >> >> anyone? >> >> On Sat, Apr 16, 2022 at 2:49 PM Matthias Apitz <guru@unixarea.de> wrote: >> >>> El d=C3=ADa s=C3=A1bado, abril 16, 2022 a las 02:23:25 +0300, Sami Hala= bi escribi=C3=B3: >>> >>> > Hi, >>> > is there anyway easy to restore deleted file by accident in UFS???? >>> >>> Yes, restore it from a backup media. >>> >>> matthias >>> >>> >>> -- >>> Matthias Apitz, =E2=9C=89 guru@unixarea.de, http://www.unixarea.de/ >>> +49-176-38902045 >>> Public GnuPG key: http://www.unixarea.de/key.pub >>> >>> Peace instead of NATO! =D0=9C=D0=B8=D1=80 =D0=B2=D0=BC=D0=B5=D1=81=D1= =82=D0=BE =D0=9D=D0=90=D0=A2=D0=9E! Frieden statt NATO! =C2=A1Paz en >>> vez de OTAN! >>> >>> >> >> -- >> Sami Halabi >> Information Systems Engineer >> NMS Projects Expert, FreeBSD SysAdmin Expert >> Asterisk Expert >> >> > > -- > Sami Halabi > Information Systems Engineer > NMS Projects Expert, FreeBSD SysAdmin Expert > Asterisk Expert > Look at autopsy/photorec https://www.cgsecurity.org/wiki/PhotoRec_Data_Carving --000000000000cf5d9a05dcc4e425 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div><br></div><div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class= =3D"gmail_attr">On Sat, 16 Apr 2022 at 09:33 Sami Halabi <<a href=3D"mai= lto:sodynet1@gmail.com">sodynet1@gmail.com</a>> wrote:<br></div><blockqu= ote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc s= olid;padding-left:1ex"><div dir=3D"ltr">how to do step 3 /?</div><br><div c= lass=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Sat, Apr 16, = 2022 at 2:59 PM Michael Gmelin <<a href=3D"mailto:grembo@freebsd.org" ta= rget=3D"_blank">grembo@freebsd.org</a>> wrote:<br></div><blockquote clas= s=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid r= gb(204,204,204);padding-left:1ex"><div dir=3D"auto"><div dir=3D"ltr"></div>= <div dir=3D"ltr">Depends on the kind of file.</div><div dir=3D"ltr"><br></d= iv><div dir=3D"ltr">You can always:</div><div dir=3D"ltr">1. reboot the sys= tem into single user mode, mount the fs readonly (important to not overwrit= e data you want to recover)</div><div dir=3D"ltr">2. dd the partition and i= nto a file</div><div dir=3D"ltr">3. find the content of the deleted file in= the dump</div><div dir=3D"ltr"><br></div><div dir=3D"ltr">I was able to re= cover a complete codebase i deleted accidentally that way a long time ago.<= /div><div dir=3D"ltr"><br></div><div dir=3D"ltr">Good luck</div><div dir=3D= "ltr">Michael</div><div dir=3D"ltr"><br><blockquote type=3D"cite">On 16. Ap= r 2022, at 13:52, Sami Halabi <<a href=3D"mailto:sodynet1@gmail.com" tar= get=3D"_blank">sodynet1@gmail.com</a>> wrote:<br><br></blockquote></div>= <blockquote type=3D"cite"><div dir=3D"ltr">=EF=BB=BF<div dir=3D"ltr">well..= thats the trivial answer.. the problem is backups is a day before... if i = can undelete it would save me loss of 1 day offset..<div><br></div><div>any= one?</div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gm= ail_attr">On Sat, Apr 16, 2022 at 2:49 PM Matthias Apitz <<a href=3D"mai= lto:guru@unixarea.de" target=3D"_blank">guru@unixarea.de</a>> wrote:<br>= </div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;b= order-left:1px solid rgb(204,204,204);padding-left:1ex">El d=C3=ADa s=C3=A1= bado, abril 16, 2022 a las 02:23:25 +0300, Sami Halabi escribi=C3=B3:<br> <br> > Hi,<br> > is there anyway easy to restore deleted file by accident in UFS????<br= > <br> Yes, restore it from a backup media.<br> <br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 matthias<br> <br> <br> -- <br> Matthias Apitz, =E2=9C=89 <a href=3D"mailto:guru@unixarea.de" target=3D"_bl= ank">guru@unixarea.de</a>, <a href=3D"http://www.unixarea.de/" rel=3D"noref= errer" target=3D"_blank">http://www.unixarea.de/</a>; +49-176-38902045<br> Public GnuPG key: <a href=3D"http://www.unixarea.de/key.pub" rel=3D"norefer= rer" target=3D"_blank">http://www.unixarea.de/key.pub</a><br>; <br> Peace instead of NATO!=C2=A0 =D0=9C=D0=B8=D1=80 =D0=B2=D0=BC=D0=B5=D1=81=D1= =82=D0=BE =D0=9D=D0=90=D0=A2=D0=9E!=C2=A0 Frieden statt NATO! =C2=A1Paz en = vez de OTAN!<br> <br> </blockquote></div><br clear=3D"all"><div><br></div>-- <br><div dir=3D"ltr"= ><div dir=3D"ltr"><div><div dir=3D"ltr">Sami Halabi<div>Information Systems= Engineer</div><div>NMS Projects Expert,=C2=A0<span style=3D"font-size:12.8= px">FreeBSD SysAdmin Expert</span></div><div>Asterisk Expert</div></div></d= iv></div></div> </div></blockquote></div></blockquote></div><br clear=3D"all"><div><br></di= v>-- <br><div dir=3D"ltr"><div dir=3D"ltr"><div><div dir=3D"ltr">Sami Halab= i<div>Information Systems Engineer</div><div>NMS Projects Expert,=C2=A0<spa= n style=3D"font-size:12.8px">FreeBSD SysAdmin Expert</span></div><div>Aster= isk Expert</div></div></div></div></div></blockquote><div dir=3D"auto"><br>= </div><div dir=3D"auto">Look at autopsy/photorec</div><div dir=3D"auto"><br= ></div><div dir=3D"auto"><div><a href=3D"https://www.cgsecurity.org/wiki/Ph= otoRec_Data_Carving">https://www.cgsecurity.org/wiki/PhotoRec_Data_Carving<= /a></div><br></div><div dir=3D"auto"><br></div><blockquote class=3D"gmail_q= uote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1e= x"><div dir=3D"ltr"><div dir=3D"ltr"><div><div dir=3D"ltr"><div dir=3D"auto= "></div></div></div></div></div> </blockquote></div></div> --000000000000cf5d9a05dcc4e425--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAGF-nS7s24yn0fCyuZbdAMjuc_5KVrYFbpKNpKzhdqRnZdK-BQ>