Date: Sat, 16 Apr 2022 14:44:52 +0200 From: Michael Gmelin <grembo@freebsd.org> To: Sami Halabi <sodynet1@gmail.com> Cc: Matthias Apitz <guru@unixarea.de>, FreeBSD Current <freebsd-current@freebsd.org> Subject: Re: recover deleted file Message-ID: <2FCD9AC4-CE69-4A22-90A5-F9C656064D7B@freebsd.org> In-Reply-To: <CAEW%2BogbUa0z0vXEDKQSmUZDHwNg6y6e9x8QNnu1i61MW_0kmKQ@mail.gmail.com> References: <CAEW%2BogbUa0z0vXEDKQSmUZDHwNg6y6e9x8QNnu1i61MW_0kmKQ@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--Apple-Mail-27FE29C9-42D0-4733-BFEC-C59306D76E4F Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable > On 16. Apr 2022, at 14:32, Sami Halabi <sodynet1@gmail.com> wrote: >=20 > =EF=BB=BF > how to do step 3 /? E.g., grep for something you know (like a phrase, unique name etc) from the f= ile, then dump N times the expected file size from that position into anothe= r file, open the result in a =E2=80=9Crobust=E2=80=9D text editor and stitch= things together. If your lost file is something binary (or even worse, encrypted), things get= a lot more complicated of course. There might be tooling for this I=E2=80=99= m not aware of, the few times this happened to me, lost files where C++ sour= ces that were relatively easy to extract manually. Best Michael >=20 >> On Sat, Apr 16, 2022 at 2:59 PM Michael Gmelin <grembo@freebsd.org> wrote= : >> Depends on the kind of file. >>=20 >> You can always: >> 1. reboot the system into single user mode, mount the fs readonly (import= ant to not overwrite data you want to recover) >> 2. dd the partition and into a file >> 3. find the content of the deleted file in the dump >>=20 >> I was able to recover a complete codebase i deleted accidentally that way= a long time ago. >>=20 >> Good luck >> Michael >>=20 >>>> On 16. Apr 2022, at 13:52, Sami Halabi <sodynet1@gmail.com> wrote: >>>>=20 >>> =EF=BB=BF >>> well.. thats the trivial answer.. the problem is backups is a day before= ... if i can undelete it would save me loss of 1 day offset.. >>>=20 >>> anyone? >>>=20 >>>> On Sat, Apr 16, 2022 at 2:49 PM Matthias Apitz <guru@unixarea.de> wrote= : >>>> El d=C3=ADa s=C3=A1bado, abril 16, 2022 a las 02:23:25 +0300, Sami Hala= bi escribi=C3=B3: >>>>=20 >>>> > Hi, >>>> > is there anyway easy to restore deleted file by accident in UFS???? >>>>=20 >>>> Yes, restore it from a backup media. >>>>=20 >>>> matthias >>>>=20 >>>>=20 >>>> --=20 >>>> Matthias Apitz, =E2=9C=89 guru@unixarea.de, http://www.unixarea.de/ +49= -176-38902045 >>>> Public GnuPG key: http://www.unixarea.de/key.pub >>>>=20 >>>> Peace instead of NATO! =D0=9C=D0=B8=D1=80 =D0=B2=D0=BC=D0=B5=D1=81=D1=82= =D0=BE =D0=9D=D0=90=D0=A2=D0=9E! Frieden statt NATO! =C2=A1Paz en vez de OT= AN! >>>>=20 >>>=20 >>>=20 >>> --=20 >>> Sami Halabi >>> Information Systems Engineer >>> NMS Projects Expert, FreeBSD SysAdmin Expert >>> Asterisk Expert >=20 >=20 > --=20 > Sami Halabi > Information Systems Engineer > NMS Projects Expert, FreeBSD SysAdmin Expert > Asterisk Expert --Apple-Mail-27FE29C9-42D0-4733-BFEC-C59306D76E4F Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html><head><meta http-equiv=3D"content-type" content=3D"text/html; charset=3D= utf-8"></head><body dir=3D"auto"><div dir=3D"ltr"></div><div dir=3D"ltr"><br= ></div><div dir=3D"ltr"><br><blockquote type=3D"cite">On 16. Apr 2022, at 14= :32, Sami Halabi <sodynet1@gmail.com> wrote:<br><br></blockquote></div= ><blockquote type=3D"cite"><div dir=3D"ltr">=EF=BB=BF<div dir=3D"ltr">how to= do step 3 /?</div></div></blockquote><div><br></div><div>E.g., grep for som= ething you know (like a phrase, unique name etc) from the file, then dump N t= imes the expected file size from that position into another file, open the r= esult in a =E2=80=9Crobust=E2=80=9D text editor and stitch things together.<= /div><div><br></div><div>If your lost file is something binary (or even wors= e, encrypted), things get a lot more complicated of course. There might be t= ooling for this I=E2=80=99m not aware of, the few times this happened to me,= lost files where C++ sources that were relatively easy to extract manually.= </div><div><br></div><div>Best</div><div>Michael</div><br><blockquote type=3D= "cite"><div dir=3D"ltr"><br><div class=3D"gmail_quote"><div dir=3D"ltr" clas= s=3D"gmail_attr">On Sat, Apr 16, 2022 at 2:59 PM Michael Gmelin <<a href=3D= "mailto:grembo@freebsd.org">grembo@freebsd.org</a>> wrote:<br></div><bloc= kquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1= px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"auto"><div dir=3D"lt= r"></div><div dir=3D"ltr">Depends on the kind of file.</div><div dir=3D"ltr"= ><br></div><div dir=3D"ltr">You can always:</div><div dir=3D"ltr">1. reboot t= he system into single user mode, mount the fs readonly (important to not ove= rwrite data you want to recover)</div><div dir=3D"ltr">2. dd the partition a= nd into a file</div><div dir=3D"ltr">3. find the content of the deleted file= in the dump</div><div dir=3D"ltr"><br></div><div dir=3D"ltr">I was able to r= ecover a complete codebase i deleted accidentally that way a long time ago.<= /div><div dir=3D"ltr"><br></div><div dir=3D"ltr">Good luck</div><div dir=3D"= ltr">Michael</div><div dir=3D"ltr"><br><blockquote type=3D"cite">On 16. Apr 2= 022, at 13:52, Sami Halabi <<a href=3D"mailto:sodynet1@gmail.com" target=3D= "_blank">sodynet1@gmail.com</a>> wrote:<br><br></blockquote></div><blockq= uote type=3D"cite"><div dir=3D"ltr">=EF=BB=BF<div dir=3D"ltr">well.. thats t= he trivial answer.. the problem is backups is a day before... if i can undel= ete it would save me loss of 1 day offset..<div><br></div><div>anyone?</div>= </div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">O= n Sat, Apr 16, 2022 at 2:49 PM Matthias Apitz <<a href=3D"mailto:guru@uni= xarea.de" target=3D"_blank">guru@unixarea.de</a>> wrote:<br></div><blockq= uote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px= solid rgb(204,204,204);padding-left:1ex">El d=C3=ADa s=C3=A1bado, abril 16,= 2022 a las 02:23:25 +0300, Sami Halabi escribi=C3=B3:<br> <br> > Hi,<br> > is there anyway easy to restore deleted file by accident in UFS????<br>= <br> Yes, restore it from a backup media.<br> <br> matthias<br> <br> <br> -- <br> Matthias Apitz, =E2=9C=89 <a href=3D"mailto:guru@unixarea.de" target=3D"_bla= nk">guru@unixarea.de</a>, <a href=3D"http://www.unixarea.de/" rel=3D"norefer= rer" target=3D"_blank">http://www.unixarea.de/</a>; +49-176-38902045<br> Public GnuPG key: <a href=3D"http://www.unixarea.de/key.pub" rel=3D"noreferr= er" target=3D"_blank">http://www.unixarea.de/key.pub</a><br>; <br> Peace instead of NATO! =D0=9C=D0=B8=D1=80 =D0=B2=D0=BC=D0=B5=D1=81=D1=82= =D0=BE =D0=9D=D0=90=D0=A2=D0=9E! Frieden statt NATO! =C2=A1Paz en vez d= e OTAN!<br> <br> </blockquote></div><br clear=3D"all"><div><br></div>-- <br><div dir=3D"ltr">= <div dir=3D"ltr"><div><div dir=3D"ltr">Sami Halabi<div>Information Systems E= ngineer</div><div>NMS Projects Expert, <span style=3D"font-size:12.8px"= >FreeBSD SysAdmin Expert</span></div><div>Asterisk Expert</div></div></div><= /div></div> </div></blockquote></div></blockquote></div><br clear=3D"all"><div><br></div= >-- <br><div dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr"><div><di= v dir=3D"ltr">Sami Halabi<div>Information Systems Engineer</div><div>NMS Pro= jects Expert, <span style=3D"font-size:12.8px">FreeBSD SysAdmin Expert<= /span></div><div>Asterisk Expert</div></div></div></div></div> </div></blockquote></body></html>= --Apple-Mail-27FE29C9-42D0-4733-BFEC-C59306D76E4F--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?2FCD9AC4-CE69-4A22-90A5-F9C656064D7B>