Fat Fingered An 'rm -rf' of Important Files

Polytropon freebsd at edvax.de
Thu Feb 28 09:02:10 UTC 2013

On Wed, 27 Feb 2013 21:08:58 -0600, Joseph A. Nagy, Jr wrote:
> Okay, I know I should pay more attention to what I'm doing, and having 
> separate partitions isn't an excuse for regular backups. If we can skip 
> the finger wagging on that part I'd appreciate it.

I've experienced similar and different "moments of unintended
successful rm", so I won't mention missing backups. ;-)

> Is there any way to retrieve any of them?

Yes, but it's not easy. Prepare to go on a journey though
file system documentation, trial & error.

Obviously we're talking about a USB stick, so no TB amount
of data has to be processed. First of all: Do _not_ alter
the USB stick in any way. No matter what you do, it can
always get worse.

> I've not wrote any data to 
> either partition since the accidental deletion.

Very good.

You can first make a copy of the file system (the whole
stick) and use that: It will be faster to access and if
you do something wrong, the original data (which we can
assume is still there) won't be affected:

	# dd if=/dev/da0 of=stick.dd

Now let me introduce you to the "list of helpful programs
in case you've done something ultimately stupid" which I
have already repeated several times on this mailing list.
I'm sure you can find some program that will help you.
See my individual notes regarding your specific situation.

I will "refactor" text from a previous message.

A worst-case tool to recover data (not file names, but file
content) is testdisk; in ports: sysutils/testdisk. It's also
on some diagnostics and recovery CDs like UBCD.

You can also try this:

	# fetch -rR <device>

Also recoverdisk could be useful.

The ports collection contains further programs that might be
worth investigating; just in case they haven't been mentioned

	dd_rescue	<- use this to make an image of the stick!
	testdisk	<- restores content

Then also


should be mentioned.

And finally, the "cure to everything" is found in The Sleuth Kit
(in ports: tsk):


Keep in mind: Read the manpages before using the programs. It's
very important to do so. You need to know what you're dealing
with, or you'll probably fail. There is no magical tetroplyrodon
to click ^Z and get everything back. :-)

Proprietary (and expensive) tools like "R-Studio" or "UFS Explorer"
can still be considered worth a try. Their trial versions are for
free. "UFS Explorer" even works using wine (I've tried it).


I've dealt with a comparable problem some months ago when
a "Windows" PC has "repaired" a FAT file system on a USB
stick, with the "excellent" result of all data being gone.
I could restore everything except the original file names
(which I wrote a script to "conclude" them from file metadata
and content).

So it should be possible.

Good luck!

Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...

More information about the freebsd-questions mailing list