Hello,

One of my coligues used this "rm -rf /" command on his ext3 partition as root
... of course :-( He removes about 50% of data. And my question is: is there a
utility to undelete the files and directories or at least some files? I know
that this shouldn't be possible but data are worth to ask :-)

Thanks a lot.

Pat
--
gentoo-user@lists.gentoo.org mailing list

On Fri, 15 Feb 2008 10:09:37 +0100, pat wrote:

> One of my coligues used this "rm -rf /" command on his ext3 partition
> as root ... of course :-( He removes about 50% of data. And my question
> is: is there a utility to undelete the files and directories or at
> least some files? I know that this shouldn't be possible but data are
> worth to ask :-)

He could try photorec from the testdisk package, but mount the filesystem
ro immediately to reduce any further damage. The output from photorec
isn't pretty and will take a lot of work to sort out what is worth
keeping, but that is all part of the learning process :P


--
Neil Bothwick

"Bother," said Pooh, as Satan laid his soul to waste.

On Friday 15 February 2008, Neil Bothwick wrote:
> On Fri, 15 Feb 2008 10:09:37 +0100, pat wrote:
> > One of my coligues used this "rm -rf /" command on his ext3
> > partition as root ... of course :-( He removes about 50% of data.
> > And my question is: is there a utility to undelete the files and
> > directories or at least some files? I know that this shouldn't be
> > possible but data are worth to ask :-)
>
> He could try photorec from the testdisk package, but mount the
> filesystem ro immediately to reduce any further damage. The output
> from photorec isn't pretty and will take a lot of work to sort out
> what is worth keeping, but that is all part of the learning process
> :P

Neil, you are a master of understatement :-)

pat, it might be possible to get some stuff back, IF he remounted ro
immediately and IF not much writing to the disk happened in the
meantime.

However, by the time you are done it is usually not worth the effort it
took. It's easier to reinstall and restore backups. But if there are
some irreplaceable files on that disk, you have no choice. good luck to
him.


--
Alan McKinnon
alan dot mckinnon at gmail dot com

--
gentoo-user@lists.gentoo.org mailing list

On Fri, 15 Feb 2008 11:41:28 +0200, Alan McKinnon wrote
> On Friday 15 February 2008, Neil Bothwick wrote:
> > On Fri, 15 Feb 2008 10:09:37 +0100, pat wrote:
> > > One of my coligues used this "rm -rf /" command on his ext3
> > > partition as root ... of course :-( He removes about 50% of data.
> > > And my question is: is there a utility to undelete the files and
> > > directories or at least some files? I know that this shouldn't be
> > > possible but data are worth to ask :-)
> >
> > He could try photorec from the testdisk package, but mount the
> > filesystem ro immediately to reduce any further damage. The output
> > from photorec isn't pretty and will take a lot of work to sort out
> > what is worth keeping, but that is all part of the learning process
> > :P
>
> Neil, you are a master of understatement :-)
>
> pat, it might be possible to get some stuff back, IF he remounted ro
> immediately and IF not much writing to the disk happened in the
> meantime.
>
> However, by the time you are done it is usually not worth the effort
> it took. It's easier to reinstall and restore backups. But if there
> are some irreplaceable files on that disk, you have no choice. good
> luck to him.
>

There's a home directory ... .

Pat
--
gentoo-user@lists.gentoo.org mailing list


Fri Feb 15 04:00:06 2008
Return-path: <launchpad-users-bounces@lists.canonical.com>
Envelope-to: tom@linux-archive.org
Delivery-date: Fri, 15 Feb 2008 03:54:19 -0600
Received: from chlorine.canonical.com ([91.189.94.204])
by server.java-tips.org with esmtp (Exim 4.68)
(envelope-from <launchpad-users-bounces@lists.canonical.com>)
id 1JPxGr-0001dH-Ux
for tom@linux-archive.org; Fri, 15 Feb 2008 03:54:18 -0600
Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com)
by chlorine.canonical.com with esmtp (Exim 4.60)
(envelope-from <launchpad-users-bounces@lists.canonical.com>)
id 1JPxGP-0005J8-17; Fri, 15 Feb 2008 09:53:49 +0000
Received: from hu-out-0506.google.com ([72.14.214.225])
by chlorine.canonical.com with esmtp (Exim 4.60)
(envelope-from <ubuntu@bugabundo.net>) id 1JPxGK-0005Gh-1o
for launchpad-users@lists.canonical.com; Fri, 15 Feb 2008 09:53:44 +0000
Received: by hu-out-0506.google.com with SMTP id 24so10436389hud.9
for <launchpad-users@lists.canonical.com>;
Fri, 15 Feb 2008 01:53:43 -0800 (PST)
Received: by 10.66.221.18 with SMTP id t18mr876500ugg.80.1203069222290;
Fri, 15 Feb 2008 01:53:42 -0800 (PST)
Received: from rhino.router.matir.pt ( [194.79.72.220])
by mx.google.com with ESMTPS id j27sm5001039ugc.65.2008.02.15.01.53.39
(version=TLSv1/SSLv3 cipher=OTHER);
Fri, 15 Feb 2008 01:53:40 -0800 (PST)
Organization: http://BUGabundo.net
To: Barry Warsaw <barry@canonical.com>
Subject: Re: ANNOUNCE: Launchpad mailing lists beta test
Date: Thu, 14 Feb 2008 21:21:08 +0000
User-Agent: KMail/1.9.6 (enterprise 0.20080118.763038)
References: <20080214012616.41126E3C45@mail.wooz.org>
In-Reply-To: <20080214012616.41126E3C45@mail.wooz.org>
MIME-Version: 1.0
Message-Id: <200802142121.12542.Ubuntu@bugabundo.net>
From: "(=?utf-8?q?=60=60-=5F-=C2=B4=C2=B4?=) -- Fernando"
<ubuntu@bugabundo.net>
Cc: launchpad-users@lists.canonical.com
X-BeenThere: launchpad-users@lists.canonical.com
X-Mailman-Version: 2.1.8
Precedence: list
Reply-To: Ubuntu@bugabundo.net, Ubuntu-reply@bugabundo.net,
launchpad-users@lists.canonical.com
List-Id: Discussion for Launchpad users <launchpad-users.lists.canonical.com>
List-Unsubscribe: <https://lists.ubuntu.com/mailman/listinfo/launchpad-users>,
<mailto:launchpad-users-request@lists.canonical.com?subject=unsubscribe>
List-Archive: <https://lists.ubuntu.com/archives/launchpad-users>
List-Post: <mailto:launchpad-users@lists.canonical.com>
List-Help: <mailto:launchpad-users-request@lists.canonical.com?subject=help>
List-Subscribe: <https://lists.ubuntu.com/mailman/listinfo/launchpad-users>,
<mailto:launchpad-users-request@lists.canonical.com?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============2608719616249744039=="
Mime-version: 1.0
Sender: launchpad-users-bounces@lists.canonical.com
Errors-To: launchpad-users-bounces@lists.canonical.com

--===============2608719616249744039==
Content-Type: multipart/signed;
boundary="nextPart2446813.NpcxfaLUYN";
protocol="application/pgp-signature";
micalg=pgp-sha1
Content-Transfer-Encoding: 7bit

--nextPart2446813.NpcxfaLUYN
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

On Thursday 14 February 2008 01:26:10 Barry Warsaw wrote:
>=20
> A little over a year ago I joined the Launchpad team to help deploy maili=
ng
> lists as another tool at your disposal when collaborating on open source
> software using Launchpad. Mailing lists are an outstanding way to cultiv=
ate a
> community around your project, not only in real-time, but also with an eye
> toward the historical record of your project as embodied in its archives.=
On
> behalf of the entire Launchpad development team, I am happy to announce t=
he
> availability of Launchpad team mailing lists to you, our beta testers.
>=20
> Enjoy,
> -Barry

Although all this seems really nice, I've found somethings strange in the e=
mail headers:

No SPF, no Canonical smtp, an PGP key....
Is this a valid email?

Thanks.

=2D-=20
BUGabundo )
(``-_-=C2=B4=C2=B4) http://Ubuntu.BUGabundo.net
Linux user #443786 GPG key 1024D/A1784EBB
My new micro-blog @ http://BUGabundo.net
ps. My emails tend to sound authority and aggressive. I'm sorry in advance.=
I'll try to be more assertive as time goes by...

--nextPart2446813.NpcxfaLUYN
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQBHtLDIcV4wzCrhCcoRAsG4AKCv5/T9dbMHFNMVT6VaAJhkVdpJuACfXkwo
nP6/4Ot47FJauhVjzze7YNo=
=EYH9
-----END PGP SIGNATURE-----

--nextPart2446813.NpcxfaLUYN--


--===============2608719616249744039==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--
launchpad-users mailing list
launchpad-users@lists.canonical.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/launchpad-users

--===============2608719616249744039==--

On Friday 15 February 2008, pat wrote:
> On Fri, 15 Feb 2008 11:41:28 +0200, Alan McKinnon wrote

> > Neil, you are a master of understatement :-)
> >
> > pat, it might be possible to get some stuff back, IF he remounted
> > ro immediately and IF not much writing to the disk happened in
> > the meantime.
> >
> > However, by the time you are done it is usually not worth the
> > effort it took. It's easier to reinstall and restore backups. But
> > if there are some irreplaceable files on that disk, you have no
> > choice. good luck to him.
>
> There's a home directory ... .

What do you mean, Pat? /home still exists and is populated? Then the
solution is easy. Back it up immediately. Re-install your whole
system and restore /home.

Uwe

--
Informal Linux Group Namibia:
http://www.linux.org.na/
SysEx (Pty) Ltd.:
http://www.SysEx.com.na/
--
gentoo-user@lists.gentoo.org mailing list

On Friday 15 February 2008, pat wrote:
> > However, by the time you are done it is usually not worth the
> > effort it took. It's easier to reinstall and restore backups. But
> > if there are some irreplaceable files on that disk, you have no
> > choice. good luck to him.
>
> There's a home directory ... .

With luck, there's a backup too!

--
Alan McKinnon
alan dot mckinnon at gmail dot com

--
gentoo-user@lists.gentoo.org mailing list

080215 pat wrote:
> One of my coligues used this "rm -rf /" command on his ext3 partition
> as root: He removes about 50% of data. is there a utility
> to undelete the files and directories or at least some files?

One of the Linux news sites relayed an article yesterday,
which mentioned several recovery apps, which are all in Gentoo :
magicrescue gpart sleuthkit foremost .

--
========================,,======================== ====================
SUPPORT ___________//___, Philip Webb : purslow@chass.utoronto.ca
ELECTRIC /] [] [] [] [] []| Centre for Urban & Community Studies
TRANSIT `-O----------O---' University of Toronto
--
gentoo-user@lists.gentoo.org mailing list

Uwe Thiem writes:





> On Friday 15 February 2008, pat wrote:


> > On Fri, 15 Feb 2008 11:41:28 +0200, Alan McKinnon wrote


> >


> > > Neil, you are a master of understatement :-)


> > >


> > > pat, it might be possible to get some stuff back, IF he remounted


> > > ro immediately and IF not much writing to the disk happened in


> > > the meantime.


> > >


> > > However, by the time you are done it is usually not worth the


> > > effort it took. It's easier to reinstall and restore backups. But


> > > if there are some irreplaceable files on that disk, you have no


> > > choice. good luck to him.


> >


> > There's a home directory ... .


>


> What do you mean, Pat? /home still exists and is populated?





I think he means there _was_ a /home directory.





I'd mout ro, and backup all files that are still there. photorec will find lots of files, but only as single files, without the directory structure. See <http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec> for a list of supported file types.





There are undelete tools for ext2, but I heard they should not work with ext3, because it zeros out things instead of just marking them as deleted as it was in ext2. However, I also heard that someone had success with midnight commander, which has an undelete feature (F9, Commands menu).





I did not try it, but this tool sounds promising:


http://freshmeat.net/projects/giis





giis (gET iT i sAY) is a file recovery tool for Ext2/Ext3 filesystems. Once installed, current files and newly created files can be recovered. It allows users to recover all deleted files, recover files owned by a specific user, dump data from old file locations, and recover files of a specific type, such as text or PNG. A forensic analyzer is also provided to assist users during recovery.





Good luck,


Wonko

On Fri, 15 Feb 2008 12:01:25 +0100, Alex Schuster wrote

> Uwe Thiem
writes:


>

> > On Friday 15 February 2008, pat
wrote:


> > > On Fri, 15 Feb 2008 11:41:28 +0200, Alan McKinnon
wrote


> >
>


> > > > Neil, you are a master of understatement
:-)


> > >
>


> > > > pat, it might be possible to get some stuff back, IF he
remounted


> > > > ro immediately and IF not much writing to the disk
happened
in


> > > > the
meantime.


> > >
>


> > > > However, by the time you are done it is usually not
worth
the


> > > > effort it took. It's easier to reinstall and restore
backups.
But


> > > > if there are some irreplaceable files on that disk, you
have
no


> > > > choice. good luck to
him.


> >
>


> > > There's a home directory ...
.


>
>


> > What do you mean, Pat? /home still exists and is populated?


>

> I think he means there _was_ a /home
directory.


>

> I'd mout ro, and backup all files that are still there.
photorec will find lots of files, but only as single files, without the
directory structure. See
<http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec> for a
list of supported file
types.


>

> There are undelete tools for ext2, but I heard they should not
work with ext3, because it zeros out things instead of just marking them as
deleted as it was in ext2. However, I also heard that someone had success with
midnight commander, which has an undelete feature (F9, Commands
menu).


>

> I did not try it, but this tool sounds
promising:


>
http://freshmeat.net/projects/giis


>

> giis (gET iT i sAY) is a file recovery tool for Ext2/Ext3
filesystems. Once installed, current files and newly created files can be
recovered. It allows users to recover all deleted files, recover files owned by
a specific user, dump data from old file locations, and recover files of a
specific type, such as text or PNG. A forensic analyzer is also provided to
assist users during
recovery.


>



Yes, there was the home directory.



Thanks to all for the help.



**** Pat