Date: Sat, 16 Apr 2022 14:48:47 +0200 From: "Julian H. Stacey" <jhs@berklix.com> To: Sami Halabi <sodynet1@gmail.com> Cc: FreeBSD Current <freebsd-current@FreeBSD.org> Subject: Re: recover deleted file Message-ID: <202204161248.23GCmlIP044778@fire.js.berklix.net> In-Reply-To: Your message "Sat, 16 Apr 2022 13:59:09 %2B0200." <70EA83C9-61AE-4256-9FF4-458197BA261D@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
> Depends on the kind of file.
>
> You can always:
> 1. reboot the system into single user mode, mount the fs readonly (important=
> to not overwrite data you want to recover)
> 2. dd the partition and into a file
> 3. find the content of the deleted file in the dump
>
> I was able to recover a complete codebase i deleted accidentally that way a l=
> ong time ago.
>
> Good luck
> Michael
If it was my personal laptop with an external disk/ stick,
I would _immediately_ pull the USB cable out.
If a personal PC I would _immediately_ turn power off.
I would Not do an unmount or sync or processes kill or shutdown.
Then I would reboot single user,
fsck & mount only the partitions the data was Not on.,
dd the partition to recover,
then fsck the partition & mount it, & go multi user,
then I'd make a 2nd copy of the partition with data to recover
& start exploration with eg fsdb
man fsdb:
SEE ALSO
editline(3), fs(5), clri(8), fsck(8), /usr/ports/ { graphics/recoverjpeg,
sysutils/ { autopsy, dd_rescue, ddrescue, fatback, ffs2recov, foremost,
gpart, magicrescue, recoverdm, scan_ffs, sleuthkit, testdisk } }.
If you work had been on text using vi, then vi -r might show a recovery,
hint copy the original before running vi -r file , as sometimes pre recovery
is better than after.
various lost+found may have stuff in
http://berklix.com/~jhs/bin/.sh/lslf
PS personaly I hand run numerous rdist6 or rsync through the day,
when editing important stuff. They run fast, as incremental update,
so avoid losing all but the last short period in a day.
Cheers,
--
Julian Stacey http://berklix.com/jhs/ http://StolenVotes.UK
Kill / remove Putin to stop him killing & provoking world war.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202204161248.23GCmlIP044778>