From owner-freebsd-questions@freebsd.org Tue May 17 15:16:04 2016 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id B601CB3F06E for ; Tue, 17 May 2016 15:16:04 +0000 (UTC) (envelope-from freebsd@edvax.de) Received: from mx02.qsc.de (mx02.qsc.de [213.148.130.14]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 7F1EE65204 for ; Tue, 17 May 2016 15:16:04 +0000 (UTC) (envelope-from freebsd@edvax.de) Received: from r56.edvax.de (port-92-195-20-216.dynamic.qsc.de [92.195.20.216]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx02.qsc.de (Postfix) with ESMTPS id 1EC8A27915; Tue, 17 May 2016 17:16:00 +0200 (CEST) Received: from r56.edvax.de (localhost [127.0.0.1]) by r56.edvax.de (8.14.5/8.14.5) with SMTP id u4HFG0g3002058; Tue, 17 May 2016 17:16:00 +0200 (CEST) (envelope-from freebsd@edvax.de) Date: Tue, 17 May 2016 17:16:00 +0200 From: Polytropon To: Shahin Hasanov Cc: FreeBSD Questions Subject: Re: recover deleted files Message-Id: <20160517171600.376a564f.freebsd@edvax.de> In-Reply-To: References: <20160517111625.414ff4f4.freebsd@edvax.de> Reply-To: Polytropon Organization: EDVAX X-Mailer: Sylpheed 3.1.1 (GTK+ 2.24.5; i386-portbld-freebsd8.2) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 May 2016 15:16:04 -0000 (Re-attaching to mailing list, hope that's okay.) On Tue, 17 May 2016 14:57:06 +0500, Shahin Hasanov wrote: > Thank you for detail information. My files Vmware machines , type > of files are vmx,vmsd, vmdk . There a big files about 50 GB. Okay, that might be a useful information. You probably have other files of that type. Check out how they start and if they are identical (for each type) in a sufficiently high number of bytes ("magic"). Then you can grep for the start of those files and dd the required size from the source disk. The files are big, so using an editor for this task is stupid. But dd will do. :-) Another idea might be to check out fsdb. It's an OS provided program which could "re-attach" the inodes - in case nothing got overwritten yet. If we take this statement as a base, the task is to assign the data to files again. This is not a trivial task, but probably still possible. > I tried to used photorec and testdisk. I can not manged recovery it. Those tools are probably the wrong ones for this task. > It gives me a lot of file. It usually recovers anything it can. > But deleted three directories which of directories contain 7-9 > files. I have Februrary backup. Anycase I'd like to repair it. > Please some advise. Check out the TSK documentation. In the past, they included good documentation with the installation. Sadly this has been moved to an online wiki which makes accessing it harder, but I found the article that formerly was "ref_fs.txt": http://wiki.sleuthkit.org/index.php?title=FS_Analysis This will provide you very helpful information on how to continue. As I initially mentioned: You need to check _which_ tool will work for your specific situation. There is no "one size fits all". -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ...