Date: Tue, 17 May 2016 17:16:00 +0200 From: Polytropon <freebsd@edvax.de> To: Shahin Hasanov <shahinhasanov@hotmail.com> Cc: FreeBSD Questions <freebsd-questions@freebsd.org> Subject: Re: recover deleted files Message-ID: <20160517171600.376a564f.freebsd@edvax.de> In-Reply-To: <DUB127-W308DA99B7AC627C7F6B612B6480@phx.gbl> References: <DUB127-W510A3F7317BB1E59669438B6480@phx.gbl> <20160517111625.414ff4f4.freebsd@edvax.de> <DUB127-W308DA99B7AC627C7F6B612B6480@phx.gbl>
next in thread | previous in thread | raw e-mail | index | archive | help
(Re-attaching to mailing list, hope that's okay.)
On Tue, 17 May 2016 14:57:06 +0500, Shahin Hasanov wrote:
> Thank you for detail information. My files Vmware machines , type
> of files are vmx,vmsd, vmdk . There a big files about 50 GB.
Okay, that might be a useful information. You probably have other
files of that type. Check out how they start and if they are
identical (for each type) in a sufficiently high number of bytes
("magic"). Then you can grep for the start of those files and
dd the required size from the source disk. The files are big,
so using an editor for this task is stupid. But dd will do. :-)
Another idea might be to check out fsdb. It's an OS provided
program which could "re-attach" the inodes - in case nothing
got overwritten yet. If we take this statement as a base, the
task is to assign the data to files again. This is not a trivial
task, but probably still possible.
> I tried to used photorec and testdisk. I can not manged recovery it.
Those tools are probably the wrong ones for this task.
> It gives me a lot of file.
It usually recovers anything it can.
> But deleted three directories which of directories contain 7-9
> files. I have Februrary backup. Anycase I'd like to repair it.
> Please some advise.
Check out the TSK documentation. In the past, they included good
documentation with the installation. Sadly this has been moved to
an online wiki which makes accessing it harder, but I found the
article that formerly was "ref_fs.txt":
http://wiki.sleuthkit.org/index.php?title=FS_Analysis
This will provide you very helpful information on how to continue.
As I initially mentioned: You need to check _which_ tool will work
for your specific situation. There is no "one size fits all".
--
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20160517171600.376a564f.freebsd>