Date: Tue, 17 May 2016 11:16:25 +0200 From: Polytropon <freebsd@edvax.de> To: Shahin Hasanov <shahinhasanov@hotmail.com> Cc: FREEBSD_QUESTION <freebsd-questions@freebsd.org> Subject: Re: recover deleted files Message-ID: <20160517111625.414ff4f4.freebsd@edvax.de> In-Reply-To: <DUB127-W510A3F7317BB1E59669438B6480@phx.gbl> References: <DUB127-W510A3F7317BB1E59669438B6480@phx.gbl>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, 17 May 2016 09:51:18 +0500, Shahin Hasanov wrote: > Hi everybody! > rsync accidentally delete my files and directories. I knew the name all > deleted files, That doesn't help much, sorry. > Please tell me how I can recover my deleted files. You cannot. Restore from backup. In fact, you can, but you need to act quickly. Do not use the partition where your data has been located. Allow no further writes. Afterwards, make yourself familiar with recovery tools. Refer to the list archive and check out my older posts regarding this topic (keywords: UFS recovery, fat fingers, undelete). I lost lots of files, too - but I was able to recover them. Keep in mind that "there is an app for this" and "one app fits all needs" does not apply. I will provide my "famous list" of recovery tools as a starting point: OS tools: fetch -rR <device> recoverdisk Ports collection: ddrescue dd_rescue <- use this to create images to work with magicrescue testdisk <- restores content recoverjpeg foremost photorec ffs2recov scan_ffs tsk <- The Sleuth Kit fls dls ils autopsy Proprietary (free test version for diagnostics): SysDev Laboratories LLC "UFS Explorer" You usually will need to understand what you're doing. Read "A Fast File System for UNIX" by M. K. McKusick. as a good introduction. It helped me a lot. http://pages.cs.wisc.edu/~dusseau/Classes/CS537-S01/ffs.pdf You will then understand why "easy undeleting" of files and directories is not possible by design. Blocks of deleted files are marked "free", and they are not connected to any inodes anymore. But as long as the blocks don't get overwritten, their content will be there. Probably TSK (The Sleuth Kit) is the way to go. In worst case, it can recover anything. But try the "easier tools" like photorec and magicrescue. What you need to do depends on the kind of files you want to recover. If you're searching for specific files, using "grep" on the disk device is possible as well; I once wrote an inefficient and stupid script for that task. Just make sure you do not cause any writes within the boundaries of the partition you want to rescue from. Write to another disk partition, disk, or USB media, or network. You can also make a copy of the whole partition and work with that (as a file). > mount > /dev/da1p1 (ufs, local, journaled soft-updates) Do not mount r/w where you want to recover from - the message is missing the "read-only" element. Any writes may destroy your data. Be very careful. Good luck. -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ...
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20160517111625.414ff4f4.freebsd>