From nobody Sat Apr 16 12:44:52 2022 X-Original-To: freebsd-current@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 6B1C27CC056 for ; Sat, 16 Apr 2022 12:44:58 +0000 (UTC) (envelope-from grembo@freebsd.org) Received: from mail.evolve.de (mail.evolve.de [213.239.217.29]) (using TLSv1.3 with cipher TLS_CHACHA20_POLY1305_SHA256 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA512 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail.evolve.de", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4KgXw916qkz4hPj; Sat, 16 Apr 2022 12:44:57 +0000 (UTC) (envelope-from grembo@freebsd.org) Received: by mail.evolve.de (OpenSMTPD) with ESMTP id 2a68bef7; Sat, 16 Apr 2022 12:44:55 +0000 (UTC) Received: by mail.evolve.de (OpenSMTPD) with ESMTPSA id 48deeb56 (TLSv1.3:AEAD-CHACHA20-POLY1305-SHA256:256:NO); Sat, 16 Apr 2022 12:44:54 +0000 (UTC) Content-Type: multipart/alternative; boundary=Apple-Mail-27FE29C9-42D0-4733-BFEC-C59306D76E4F Content-Transfer-Encoding: 7bit List-Id: Discussions about the use of FreeBSD-current List-Archive: https://lists.freebsd.org/archives/freebsd-current List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-current@freebsd.org Mime-Version: 1.0 (1.0) Subject: Re: recover deleted file From: Michael Gmelin In-Reply-To: Date: Sat, 16 Apr 2022 14:44:52 +0200 Cc: Matthias Apitz , FreeBSD Current Message-Id: <2FCD9AC4-CE69-4A22-90A5-F9C656064D7B@freebsd.org> References: To: Sami Halabi X-Mailer: iPhone Mail (19D52) X-Rspamd-Queue-Id: 4KgXw916qkz4hPj X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=softfail (mx1.freebsd.org: 213.239.217.29 is neither permitted nor denied by domain of grembo@freebsd.org) smtp.mailfrom=grembo@freebsd.org X-Spamd-Result: default: False [-2.49 / 15.00]; ARC_NA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; FREEFALL_USER(0.00)[grembo]; FROM_HAS_DN(0.00)[]; RCPT_COUNT_THREE(0.00)[3]; MV_CASE(0.50)[]; NEURAL_HAM_LONG(-1.00)[-1.000]; MIME_GOOD(-0.10)[multipart/alternative,text/plain]; DMARC_NA(0.00)[freebsd.org]; NEURAL_HAM_MEDIUM(-0.95)[-0.949]; R_SPF_SOFTFAIL(0.00)[~all:c]; RCVD_COUNT_THREE(0.00)[3]; TO_MATCH_ENVRCPT_SOME(0.00)[]; TO_DN_ALL(0.00)[]; NEURAL_HAM_SHORT(-0.94)[-0.945]; MLMMJ_DEST(0.00)[freebsd-current]; FREEMAIL_TO(0.00)[gmail.com]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+,1:+,2:~]; ASN(0.00)[asn:24940, ipnet:213.239.192.0/18, country:DE]; RCVD_TLS_ALL(0.00)[]; MID_RHS_MATCH_FROM(0.00)[] X-ThisMailContainsUnwantedMimeParts: N --Apple-Mail-27FE29C9-42D0-4733-BFEC-C59306D76E4F Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable > On 16. Apr 2022, at 14:32, Sami Halabi wrote: >=20 > =EF=BB=BF > how to do step 3 /? E.g., grep for something you know (like a phrase, unique name etc) from the f= ile, then dump N times the expected file size from that position into anothe= r file, open the result in a =E2=80=9Crobust=E2=80=9D text editor and stitch= things together. If your lost file is something binary (or even worse, encrypted), things get= a lot more complicated of course. There might be tooling for this I=E2=80=99= m not aware of, the few times this happened to me, lost files where C++ sour= ces that were relatively easy to extract manually. Best Michael >=20 >> On Sat, Apr 16, 2022 at 2:59 PM Michael Gmelin wrote= : >> Depends on the kind of file. >>=20 >> You can always: >> 1. reboot the system into single user mode, mount the fs readonly (import= ant to not overwrite data you want to recover) >> 2. dd the partition and into a file >> 3. find the content of the deleted file in the dump >>=20 >> I was able to recover a complete codebase i deleted accidentally that way= a long time ago. >>=20 >> Good luck >> Michael >>=20 >>>> On 16. Apr 2022, at 13:52, Sami Halabi wrote: >>>>=20 >>> =EF=BB=BF >>> well.. thats the trivial answer.. the problem is backups is a day before= ... if i can undelete it would save me loss of 1 day offset.. >>>=20 >>> anyone? >>>=20 >>>> On Sat, Apr 16, 2022 at 2:49 PM Matthias Apitz wrote= : >>>> El d=C3=ADa s=C3=A1bado, abril 16, 2022 a las 02:23:25 +0300, Sami Hala= bi escribi=C3=B3: >>>>=20 >>>> > Hi, >>>> > is there anyway easy to restore deleted file by accident in UFS???? >>>>=20 >>>> Yes, restore it from a backup media. >>>>=20 >>>> matthias >>>>=20 >>>>=20 >>>> --=20 >>>> Matthias Apitz, =E2=9C=89 guru@unixarea.de, http://www.unixarea.de/ +49= -176-38902045 >>>> Public GnuPG key: http://www.unixarea.de/key.pub >>>>=20 >>>> Peace instead of NATO! =D0=9C=D0=B8=D1=80 =D0=B2=D0=BC=D0=B5=D1=81=D1=82= =D0=BE =D0=9D=D0=90=D0=A2=D0=9E! Frieden statt NATO! =C2=A1Paz en vez de OT= AN! >>>>=20 >>>=20 >>>=20 >>> --=20 >>> Sami Halabi >>> Information Systems Engineer >>> NMS Projects Expert, FreeBSD SysAdmin Expert >>> Asterisk Expert >=20 >=20 > --=20 > Sami Halabi > Information Systems Engineer > NMS Projects Expert, FreeBSD SysAdmin Expert > Asterisk Expert --Apple-Mail-27FE29C9-42D0-4733-BFEC-C59306D76E4F Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

On 16. Apr 2022, at 14= :32, Sami Halabi <sodynet1@gmail.com> wrote:

=EF=BB=BF
how to= do step 3 /?

E.g., grep for som= ething you know (like a phrase, unique name etc) from the file, then dump N t= imes the expected file size from that position into another file, open the r= esult in a =E2=80=9Crobust=E2=80=9D text editor and stitch things together.<= /div>

If your lost file is something binary (or even wors= e, encrypted), things get a lot more complicated of course. There might be t= ooling for this I=E2=80=99m not aware of, the few times this happened to me,= lost files where C++ sources that were relatively easy to extract manually.=

Best
Michael


On Sat, Apr 16, 2022 at 2:59 PM Michael Gmelin <grembo@freebsd.org> wrote:
Depends on the kind of file.

You can always:
1. reboot t= he system into single user mode, mount the fs readonly (important to not ove= rwrite data you want to recover)
2. dd the partition a= nd into a file
3. find the content of the deleted file= in the dump

I was able to r= ecover a complete codebase i deleted accidentally that way a long time ago.<= /div>

Good luck
Michael

On 16. Apr 2= 022, at 13:52, Sami Halabi <sodynet1@gmail.com> wrote:

=EF=BB=BF
well.. thats t= he trivial answer.. the problem is backups is a day before... if i can undel= ete it would save me loss of 1 day offset..

anyone?
=

O= n Sat, Apr 16, 2022 at 2:49 PM Matthias Apitz <guru@unixarea.de> wrote:
El d=C3=ADa s=C3=A1bado, abril 16,= 2022 a las 02:23:25 +0300, Sami Halabi escribi=C3=B3:

> Hi,
> is there anyway easy to restore deleted file by accident in UFS????
=
Yes, restore it from a backup media.

        matthias


--
Matthias Apitz, =E2=9C=89 guru@unixarea.de, http://www.unixarea.de/ +49-176-38902045
Public GnuPG key: http://www.unixarea.de/key.pub

Peace instead of NATO!  =D0=9C=D0=B8=D1=80 =D0=B2=D0=BC=D0=B5=D1=81=D1=82= =D0=BE =D0=9D=D0=90=D0=A2=D0=9E!  Frieden statt NATO! =C2=A1Paz en vez d= e OTAN!



--
=
Sami Halabi
Information Systems E= ngineer
NMS Projects Expert, FreeBSD SysAdmin Expert
Asterisk Expert
<= /div>


--
Sami Halabi
Information Systems Engineer
NMS Pro= jects Expert, FreeBSD SysAdmin Expert<= /span>
Asterisk Expert
= --Apple-Mail-27FE29C9-42D0-4733-BFEC-C59306D76E4F--