Fat Fingered An 'rm -rf' of Important Files

[Polytropon]

On Wed, 27 Feb 2013 21:08:58 -0600, Joseph A. Nagy, Jr wrote:
> Okay, I know I should pay more attention to what I'm doing, and having 
> separate partitions isn't an excuse for regular backups. If we can skip 
> the finger wagging on that part I'd appreciate it.

I've experienced similar and different "moments of unintended
successful rm", so I won't mention missing backups. ;-)



> Is there any way to retrieve any of them?

Yes, but it's not easy. Prepare to go on a journey though
file system documentation, trial & error.

Obviously we're talking about a USB stick, so no TB amount
of data has to be processed. First of all: Do _not_ alter
the USB stick in any way. No matter what you do, it can
always get worse.



> I've not wrote any data to 
> either partition since the accidental deletion.

Very good.

You can first make a copy of the file system (the whole
stick) and use that: It will be faster to access and if
you do something wrong, the original data (which we can
assume is still there) won't be affected:

	# dd if=/dev/da0 of=stick.dd

Now let me introduce you to the "list of helpful programs
in case you've done something ultimately stupid" which I
have already repeated several times on this mailing list.
I'm sure you can find some program that will help you.
See my individual notes regarding your specific situation.

I will "refactor" text from a previous message.

A worst-case tool to recover data (not file names, but file
content) is testdisk; in ports: sysutils/testdisk. It's also
on some diagnostics and recovery CDs like UBCD.

You can also try this:

	# fetch -rR <device>

Also recoverdisk could be useful.

The ports collection contains further programs that might be
worth investigating; just in case they haven't been mentioned
yet:

	ddrescue
	dd_rescue	<- use this to make an image of the stick!
	magicrescue
	testdisk	<- restores content
	recoverjpeg
	foremost
	photorec

Then also

	ffs2recov
	scan_ffs

should be mentioned.

And finally, the "cure to everything" is found in The Sleuth Kit
(in ports: tsk):

	fls
	dls
	ils
	autopsy

Keep in mind: Read the manpages before using the programs. It's
very important to do so. You need to know what you're dealing
with, or you'll probably fail. There is no magical tetroplyrodon
to click ^Z and get everything back. :-)

Proprietary (and expensive) tools like "R-Studio" or "UFS Explorer"
can still be considered worth a try. Their trial versions are for
free. "UFS Explorer" even works using wine (I've tried it).

Note:

I've dealt with a comparable problem some months ago when
a "Windows" PC has "repaired" a FAT file system on a USB
stick, with the "excellent" result of all data being gone.
I could restore everything except the original file names
(which I wrote a script to "conclude" them from file metadata
and content).

So it should be possible.




Good luck!




-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...