accidently deleted files from directory
Hi and thx for your help,
I'm running a gentoo box and using xfs as file system.
On the weekend it happens that I accidentally deleted 1 TB of data (rm -rdf /mnt/lcq). We have no backup of the data (internal reasons of the university...) and it would be nice to get the data somehow back.
After the delete the first step was to unmount the partion and this are the info's from the xfs_check program.
meta-data=/mnt/lcq isize=256 agcount=32, agsize=9154978
blks
= sectsz=512
data = bsize=4096 blocks=292959296, imaxpct=25
= sunit=0 swidth=0 blks, unwritten=1
naming =version 2 bsize=4096
log =internal bsize=4096 blocks=32768, version=1
= sectsz=512 sunit=0 blks
realtime =none extsz=65536 blocks=0, rtextents=0after I did a cat /dev/sda1 | less I could see that some data are still exist and are not overwritten. So I think "all" what I have todo is some how get the journal back.
Is there anyway or is all hope lost?
Thx gert
p.s. pleace CC me ([email protected]) because I'm not a member of this mailing list.
Quoted 4 lines · gert wohlgemuth
On the weekend it happens that I accidentally deleted 1 TB of data (rm -rdf
/mnt/lcq). We have no backup of the data (internal reasons of the university...) and it would be nice to get the data somehow back.
ouch
Quoted 3 lines
after I did a cat
/dev/sda1| less I could see that some data are still exist and are not overwritten. So I think "all" what I have todo is some how get the journal back.
that won't suffice, the metadata showing where all the files are is likely gone
Quoted 1 line
Is there anyway or is all hope lost?
if you know what the data looks like heuristically scan for it and try to glue the fragments back together...
Thx,
I thought so that the data are gone and it's to much to glue it, cause all binary data.
So time to step back to ext2, here at least I can restore the data in the worst case.
...not that it ever happens again...
g.
-----Original Message-----
From: Chris Wedgwood [mailto:[email protected]]
Sent: Monday, August 28, 2006 9:17 PM
To: gert wohlgemuth
Cc: [email protected]
Subject: Re: accidently deleted files from directory
Quoted 4 lines · gert wohlgemuth
On the weekend it happens that I accidentally deleted 1 TB of data (rm -rdf
/mnt/lcq). We have no backup of the data (internal reasons of the university...) and it would be nice to get the data somehow back.
ouch
Quoted 2 lines
after I did a cat
/dev/sda1| less I could see that some data are still exist and are not overwritten. So I think "all" what I have todo is some
how
Quoted 1 line
get the journal back.
that won't suffice, the metadata showing where all the files are is likely gone
Quoted 1 line
Is there anyway or is all hope lost?
if you know what the data looks like heuristically scan for it and try to glue the fragments back together...
Quoted 7 lines · gert wohlgemuth
Thx,
I thought so that the data are gone and it's to much to glue it, cause all binary data.
So time to step back to ext2, here at least I can restore the data in the worst case.
Just out of curiosity, could you write an info to the list, how long your 'some-terrabyte-ext2'-filesystem needs to mount and - every 20th-or -so mount, how long a fsck is running on when if it's well filled ;-). I once tried to restore deleted files on a webserver using ext2, i can tell you, thats no fun. Many programs make copies of the files they are working on, write there changes, delete the old file and rename the new. So expect to get lots and lots of versions of files where you have to decide which is the latest you want to use, and sometimes, its not the latest by accesstime ...
Quoted 10 lines
...not that it ever happens again...
Quoted 2 lines
after I did a cat
/dev/sda1| less I could see that some data are still exist and are not overwritten. So I think "all" what I have todo is somehow
Quoted 1 line
get the journal back.
that won't suffice, the metadata showing where all the files are is likely gone
Well, getting a consistent state ( in this case all metadata removed ) is why we use filesystems like XFS.
Signature · 8 lines
Mit freundlichen Grüssen / best regards Klaus Strebel, Dipl.-Inform. (FH), mailto:[email protected] /"\ \ / ASCII RIBBON CAMPAIGN X AGAINST HTML MAIL / \
Quoted 21 lines · gert wohlgemuth
Hi and thx for your help,
I'm running a gentoo box and using xfs as file system.
On the weekend it happens that I accidentally deleted 1 TB of data (rm -rdf
/mnt/lcq). We have no backup of the data (internal reasons of the university...) and it would be nice to get the data somehow back.After the delete the first step was to unmount the partion and this are the info's from the
xfs_checkprogram.meta-data=/mnt/lcq isize=256 agcount=32, agsize=9154978
blks= sectsz=512 data = bsize=4096 blocks=292959296, imaxpct=25 = sunit=0 swidth=0 blks, unwritten=1 naming =version 2 bsize=4096 log =internal bsize=4096 blocks=32768, version=1 = sectsz=512 sunit=0 blks realtime =none extsz=65536 blocks=0, rtextents=0
Quoted 4 lines
after I did a cat
/dev/sda1| less I could see that some data are still exist and are not overwritten. So I think "all" what I have todo is some how get the journal back.
What journal would that be?
If you are referring to the xfs journal or log, then that won't help you. It is just logging metadata.
It is also only designed for replay for metadata which didn't make it to disk.
Quoted 1 line
Is there anyway or is all hope lost?
We don't support undelete as the FAQ says :)
I suggest you go thru the mailing list archive and see if anyone has suggestions for scanning the device. Good luck :)
--Tim
Quoted 31 lines · Timothy Shimmin
Quoted 21 lines · gert wohlgemuth
Hi and thx for your help,
I'm running a gentoo box and using xfs as file system.
On the weekend it happens that I accidentally deleted 1 TB of data (rm -rdf
/mnt/lcq). We have no backup of the data (internal reasons of the university...) and it would be nice to get the data somehow back.After the delete the first step was to unmount the partion and this are the info's from the
xfs_checkprogram.meta-data=/mnt/lcq isize=256 agcount=32, agsize=9154978
blks= sectsz=512 data = bsize=4096 blocks=292959296, imaxpct=25 = sunit=0 swidth=0 blks, unwritten=1 naming =version 2 bsize=4096 log =internal bsize=4096 blocks=32768, version=1 = sectsz=512 sunit=0 blks realtime =none extsz=65536 blocks=0, rtextents=0Quoted 4 lines
after I did a cat
/dev/sda1| less I could see that some data are still exist and are not overwritten. So I think "all" what I have todo is some how get the journal back.What journal would that be?
If you are referring to the xfs journal or log, then that won't help you. It is just logging metadata.
It is also only designed for replay for metadata which didn't make it to disk.
Quoted 4 lines
Quoted 1 line
Is there anyway or is all hope lost?
We don't support undelete as the FAQ says :)
I suggest you go thru the mailing list archive and see if anyone has suggestions for scanning the device. Good luck :)
It won't be easy. All depends on what data did you have on that disk. I remember that some time ago a friend of mine has deleted a lot of jpegs from one partition. I was able to recover most of the data just reading the disk, looking for something that looked like the beginning of jpeg file and then copying till the end marker or < 6 MB. If you know what data were on the device and what to do find them out, the filesystem is not too fragmented and single files are not big then you should be able to relativelly easy recover the data. Just find somebody at your university that knows a little C programming and you should be fine. In other case - if the data are woth it - I would look for a company specialized in data recovery, but that will be pricey :(
Regards,
Olaf
Signature · 1 line
Olaf Frączyk <[email protected]>
Yeah like always (it would be boring afterwards)
1. our file size is between 100k - 20 GB
2. we have tons of these files...
3. we have all kind of files from xls,xml,bz2 to special files from scientific machines.
In short we gave up and considering it a loss and a lesson for the future.
At least I get now the money for a backup server with some space...
Thx for all your help!
gert
-----Original Message-----
From: Olaf Frączyk [mailto:[email protected]]
Sent: Tuesday, August 29, 2006 1:04 AM
To: Timothy Shimmin
Cc: gert wohlgemuth; [email protected]
Subject: Re: accidently deleted files from directory
Quoted 6 lines · Timothy Shimmin
Quoted 5 lines · gert wohlgemuth
Hi and thx for your help,
I'm running a gentoo box and using xfs as file system.
On the weekend it happens that I accidentally deleted 1 TB of data (rm
-rdf
Quoted 4 lines
Quoted 4 lines
/mnt/lcq). We have no backup of the data (internal reasons of the university...) and it would be nice to get the data somehow back.After the delete the first step was to unmount the partion and this are
the
Quoted 6 lines
Quoted 6 lines
info's from the
xfs_checkprogram.meta-data=/mnt/lcq isize=256 agcount=32, agsize=9154978
blks
= sectsz=512
data = bsize=4096 blocks=292959296,
imaxpct=25
Quoted 8 lines
Quoted 8 lines
= sunit=0 swidth=0 blks, unwritten=1 naming =version 2 bsize=4096 log =internal bsize=4096 blocks=32768, version=1 = sectsz=512 sunit=0 blks realtime =none extsz=65536 blocks=0, rtextents=0after I did a cat
/dev/sda1| less I could see that some data are still exist and are not overwritten. So I think "all" what I have todo is some
how
Quoted 6 lines
Quoted 2 lines
get the journal back.
What journal would that be?
If you are referring to the xfs journal or log, then that won't help you. It is just logging metadata.
It is also only designed for replay for metadata which didn't make it to
disk.
Quoted 4 lines
Quoted 2 lines
Is there anyway or is all hope lost?
We don't support undelete as the FAQ says :)
I suggest you go thru the mailing list archive and see if anyone has
suggestions
Quoted 1 line
for scanning the device. Good luck :)
It won't be easy. All depends on what data did you have on that disk. I remember that some time ago a friend of mine has deleted a lot of jpegs from one partition. I was able to recover most of the data just reading the disk, looking for something that looked like the beginning of jpeg file and then copying till the end marker or < 6 MB. If you know what data were on the device and what to do find them out, the filesystem is not too fragmented and single files are not big then you should be able to relativelly easy recover the data. Just find somebody at your university that knows a little C programming and you should be fine. In other case - if the data are woth it - I would look for a company specialized in data recovery, but that will be pricey :(
Regards,
Olaf
Signature · 1 line
Olaf Frączyk <[email protected]>