Date: Sat, 16 Apr 2022 14:44:52 +0200 From: Michael Gmelin <grembo@freebsd.org> To: Sami Halabi <sodynet1@gmail.com> Cc: Matthias Apitz <guru@unixarea.de>, FreeBSD Current <freebsd-current@freebsd.org> Subject: Re: recover deleted file Message-ID: <2FCD9AC4-CE69-4A22-90A5-F9C656064D7B@freebsd.org> In-Reply-To: <CAEW%2BogbUa0z0vXEDKQSmUZDHwNg6y6e9x8QNnu1i61MW_0kmKQ@mail.gmail.com> References: <CAEW%2BogbUa0z0vXEDKQSmUZDHwNg6y6e9x8QNnu1i61MW_0kmKQ@mail.gmail.com>
index | next in thread | previous in thread | raw e-mail
[-- Attachment #1 --] > On 16. Apr 2022, at 14:32, Sami Halabi <sodynet1@gmail.com> wrote: > > > how to do step 3 /? E.g., grep for something you know (like a phrase, unique name etc) from the file, then dump N times the expected file size from that position into another file, open the result in a “robust” text editor and stitch things together. If your lost file is something binary (or even worse, encrypted), things get a lot more complicated of course. There might be tooling for this I’m not aware of, the few times this happened to me, lost files where C++ sources that were relatively easy to extract manually. Best Michael > >> On Sat, Apr 16, 2022 at 2:59 PM Michael Gmelin <grembo@freebsd.org> wrote: >> Depends on the kind of file. >> >> You can always: >> 1. reboot the system into single user mode, mount the fs readonly (important to not overwrite data you want to recover) >> 2. dd the partition and into a file >> 3. find the content of the deleted file in the dump >> >> I was able to recover a complete codebase i deleted accidentally that way a long time ago. >> >> Good luck >> Michael >> >>>> On 16. Apr 2022, at 13:52, Sami Halabi <sodynet1@gmail.com> wrote: >>>> >>> >>> well.. thats the trivial answer.. the problem is backups is a day before... if i can undelete it would save me loss of 1 day offset.. >>> >>> anyone? >>> >>>> On Sat, Apr 16, 2022 at 2:49 PM Matthias Apitz <guru@unixarea.de> wrote: >>>> El día sábado, abril 16, 2022 a las 02:23:25 +0300, Sami Halabi escribió: >>>> >>>> > Hi, >>>> > is there anyway easy to restore deleted file by accident in UFS???? >>>> >>>> Yes, restore it from a backup media. >>>> >>>> matthias >>>> >>>> >>>> -- >>>> Matthias Apitz, ✉ guru@unixarea.de, http://www.unixarea.de/ +49-176-38902045 >>>> Public GnuPG key: http://www.unixarea.de/key.pub >>>> >>>> Peace instead of NATO! Мир вместо НАТО! Frieden statt NATO! ¡Paz en vez de OTAN! >>>> >>> >>> >>> -- >>> Sami Halabi >>> Information Systems Engineer >>> NMS Projects Expert, FreeBSD SysAdmin Expert >>> Asterisk Expert > > > -- > Sami Halabi > Information Systems Engineer > NMS Projects Expert, FreeBSD SysAdmin Expert > Asterisk Expert [-- Attachment #2 --] <html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr"></div><div dir="ltr"><br></div><div dir="ltr"><br><blockquote type="cite">On 16. Apr 2022, at 14:32, Sami Halabi <sodynet1@gmail.com> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div dir="ltr">how to do step 3 /?</div></div></blockquote><div><br></div><div>E.g., grep for something you know (like a phrase, unique name etc) from the file, then dump N times the expected file size from that position into another file, open the result in a “robust” text editor and stitch things together.</div><div><br></div><div>If your lost file is something binary (or even worse, encrypted), things get a lot more complicated of course. There might be tooling for this I’m not aware of, the few times this happened to me, lost files where C++ sources that were relatively easy to extract manually.</div><div><br></div><div>Best</div><div>Michael</div><br><blockquote type="cite"><div dir="ltr"><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Apr 16, 2022 at 2:59 PM Michael Gmelin <<a href="mailto:grembo@freebsd.org">grembo@freebsd.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto"><div dir="ltr"></div><div dir="ltr">Depends on the kind of file.</div><div dir="ltr"><br></div><div dir="ltr">You can always:</div><div dir="ltr">1. reboot the system into single user mode, mount the fs readonly (important to not overwrite data you want to recover)</div><div dir="ltr">2. dd the partition and into a file</div><div dir="ltr">3. find the content of the deleted file in the dump</div><div dir="ltr"><br></div><div dir="ltr">I was able to recover a complete codebase i deleted accidentally that way a long time ago.</div><div dir="ltr"><br></div><div dir="ltr">Good luck</div><div dir="ltr">Michael</div><div dir="ltr"><br><blockquote type="cite">On 16. Apr 2022, at 13:52, Sami Halabi <<a href="mailto:sodynet1@gmail.com" target="_blank">sodynet1@gmail.com</a>> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div dir="ltr">well.. thats the trivial answer.. the problem is backups is a day before... if i can undelete it would save me loss of 1 day offset..<div><br></div><div>anyone?</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Apr 16, 2022 at 2:49 PM Matthias Apitz <<a href="mailto:guru@unixarea.de" target="_blank">guru@unixarea.de</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">El día sábado, abril 16, 2022 a las 02:23:25 +0300, Sami Halabi escribió:<br> <br> > Hi,<br> > is there anyway easy to restore deleted file by accident in UFS????<br> <br> Yes, restore it from a backup media.<br> <br> matthias<br> <br> <br> -- <br> Matthias Apitz, ✉ <a href="mailto:guru@unixarea.de" target="_blank">guru@unixarea.de</a>, <a href="http://www.unixarea.de/" rel="noreferrer" target="_blank">http://www.unixarea.de/</a>; +49-176-38902045<br> Public GnuPG key: <a href="http://www.unixarea.de/key.pub" rel="noreferrer" target="_blank">http://www.unixarea.de/key.pub</a><br>; <br> Peace instead of NATO! Мир вместо НАТО! Frieden statt NATO! ¡Paz en vez de OTAN!<br> <br> </blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr"><div dir="ltr"><div><div dir="ltr">Sami Halabi<div>Information Systems Engineer</div><div>NMS Projects Expert, <span style="font-size:12.8px">FreeBSD SysAdmin Expert</span></div><div>Asterisk Expert</div></div></div></div></div> </div></blockquote></div></blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr">Sami Halabi<div>Information Systems Engineer</div><div>NMS Projects Expert, <span style="font-size:12.8px">FreeBSD SysAdmin Expert</span></div><div>Asterisk Expert</div></div></div></div></div> </div></blockquote></body></html>help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?2FCD9AC4-CE69-4A22-90A5-F9C656064D7B>