Fat Fingered An 'rm -rf' of Important Files

Joseph A. Nagy, Jr jnagyjr1978 at gmail.com
Thu Feb 28 11:55:49 UTC 2013

On 02/28/13 03:02, Polytropon wrote:
> On Wed, 27 Feb 2013 21:08:58 -0600, Joseph A. Nagy, Jr wrote:
>> Okay, I know I should pay more attention to what I'm doing, and having
>> separate partitions isn't an excuse for regular backups. If we can skip
>> the finger wagging on that part I'd appreciate it.
> I've experienced similar and different "moments of unintended
> successful rm", so I won't mention missing backups. ;-)


>> Is there any way to retrieve any of them?
> Yes, but it's not easy. Prepare to go on a journey though
> file system documentation, trial & error.
> Obviously we're talking about a USB stick, so no TB amount
> of data has to be processed. First of all: Do _not_ alter
> the USB stick in any way. No matter what you do, it can
> always get worse.

Oh no, not a USB stick, I'm talking hdd partitions (4GiB on one, 64GiB 
on another) but it will be the same process. I'll see about investing in 
an external hard drive.

>> I've not wrote any data to
>> either partition since the accidental deletion.
> Very good.
> You can first make a copy of the file system (the whole
> stick) and use that: It will be faster to access and if
> you do something wrong, the original data (which we can
> assume is still there) won't be affected:
> 	# dd if=/dev/da0 of=stick.dd
> Now let me introduce you to the "list of helpful programs
> in case you've done something ultimately stupid" which I
> have already repeated several times on this mailing list.
> I'm sure you can find some program that will help you.
> See my individual notes regarding your specific situation.
> I will "refactor" text from a previous message.
> A worst-case tool to recover data (not file names, but file
> content) is testdisk; in ports: sysutils/testdisk. It's also
> on some diagnostics and recovery CDs like UBCD.

I've tried test disk but it doesn't have a UFS option for some reason.

> You can also try this:
> 	# fetch -rR <device>

where would I fetch to?

> Also recoverdisk could be useful.

also in /usr/ports/sysutils ?

> The ports collection contains further programs that might be
> worth investigating; just in case they haven't been mentioned
> yet:
> 	ddrescue
> 	dd_rescue	<- use this to make an image of the stick!
> 	magicrescue
> 	testdisk	<- restores content
> 	recoverjpeg
> 	foremost
> 	photorec
> Then also
> 	ffs2recov
> 	scan_ffs
> should be mentioned.
> And finally, the "cure to everything" is found in The Sleuth Kit
> (in ports: tsk):
> 	fls
> 	dls
> 	ils
> 	autopsy


> Keep in mind: Read the manpages before using the programs. It's
> very important to do so. You need to know what you're dealing

the testdisk man page is very unhelpful. ):

> with, or you'll probably fail. There is no magical tetroplyrodon
> to click ^Z and get everything back. :-)

well, not so sure. Found a Windows program to recover deleted stuff on 
UFS, but I imagine it's harder touse then the above (and more 
expensive). I will definitely work on the above first.

> Proprietary (and expensive) tools like "R-Studio" or "UFS Explorer"
> can still be considered worth a try. Their trial versions are for
> free. "UFS Explorer" even works using wine (I've tried it).

I have a frustrating history with wine but will give it a go (also, 
amd64 here, so who knows).

> Note:
> I've dealt with a comparable problem some months ago when
> a "Windows" PC has "repaired" a FAT file system on a USB
> stick, with the "excellent" result of all data being gone.
> I could restore everything except the original file names
> (which I wrote a script to "conclude" them from file metadata
> and content).
> So it should be possible.
> Good luck!

Thanks a million, you've saved me a lot of money (hopefully!)

Yours in Christ,

Joseph A Nagy Jr
"Whoever loves instruction loves knowledge, But he who hates correction
is stupid." -- Proverbs 12:1
Emails are not formal business letters, whatever businesses may want.
Original content CopyFree (F) under the OWL 

More information about the freebsd-questions mailing list