Fat Fingered An 'rm -rf' of Important Files

[Doug Hardie]

On 28 February 2013, at 01:02, Polytropon <freebsd at edvax.de> wrote:

> On Wed, 27 Feb 2013 21:08:58 -0600, Joseph A. Nagy, Jr wrote:
>> Okay, I know I should pay more attention to what I'm doing, and having 
>> separate partitions isn't an excuse for regular backups. If we can skip 
>> the finger wagging on that part I'd appreciate it.
> 
> I've experienced similar and different "moments of unintended
> successful rm", so I won't mention missing backups. ;-)
> 
> 
> 
>> Is there any way to retrieve any of them?
> 
> Yes, but it's not easy. Prepare to go on a journey though
> file system documentation, trial & error.
> 
> Obviously we're talking about a USB stick, so no TB amount
> of data has to be processed. First of all: Do _not_ alter
> the USB stick in any way. No matter what you do, it can
> always get worse.
> 
> 
> 
>> I've not wrote any data to 
>> either partition since the accidental deletion.
> 
> Very good.
> 
> You can first make a copy of the file system (the whole
> stick) and use that: It will be faster to access and if
> you do something wrong, the original data (which we can
> assume is still there) won't be affected:
> 
> 	# dd if=/dev/da0 of=stick.dd
> 
> Now let me introduce you to the "list of helpful programs
> in case you've done something ultimately stupid" which I
> have already repeated several times on this mailing list.
> I'm sure you can find some program that will help you.
> See my individual notes regarding your specific situation.
> 
> I will "refactor" text from a previous message.
> 
> A worst-case tool to recover data (not file names, but file
> content) is testdisk; in ports: sysutils/testdisk. It's also
> on some diagnostics and recovery CDs like UBCD.
> 
> You can also try this:
> 
> 	# fetch -rR <device>
> 
> Also recoverdisk could be useful.
> 
> The ports collection contains further programs that might be
> worth investigating; just in case they haven't been mentioned
> yet:
> 
> 	ddrescue
> 	dd_rescue	<- use this to make an image of the stick!
> 	magicrescue
> 	testdisk	<- restores content
> 	recoverjpeg
> 	foremost
> 	photorec
> 
> Then also
> 
> 	ffs2recov
> 	scan_ffs
> 
> should be mentioned.
> 
> And finally, the "cure to everything" is found in The Sleuth Kit
> (in ports: tsk):
> 
> 	fls
> 	dls
> 	ils
> 	autopsy
> 
> Keep in mind: Read the manpages before using the programs. It's
> very important to do so. You need to know what you're dealing
> with, or you'll probably fail. There is no magical tetroplyrodon
> to click ^Z and get everything back. :-)
> 
> Proprietary (and expensive) tools like "R-Studio" or "UFS Explorer"
> can still be considered worth a try. Their trial versions are for
> free. "UFS Explorer" even works using wine (I've tried it).
> 
> Note:
> 
> I've dealt with a comparable problem some months ago when
> a "Windows" PC has "repaired" a FAT file system on a USB
> stick, with the "excellent" result of all data being gone.
> I could restore everything except the original file names
> (which I wrote a script to "conclude" them from file metadata
> and content).
> 
> So it should be possible.

I see this issue way too often.  The above information should be put in the Handbook.  It would be nice to have it fleshed out more, but if nothing else, the above would be helpful to others who run into similar issues.