recover deleted files
freebsd at edvax.de
Tue May 17 09:25:04 UTC 2016
On Tue, 17 May 2016 09:51:18 +0500, Shahin Hasanov wrote:
> Hi everybody!
> rsync accidentally delete my files and directories. I knew the name all
> deleted files,
That doesn't help much, sorry.
> Please tell me how I can recover my deleted files.
You cannot. Restore from backup.
In fact, you can, but you need to act quickly. Do not use the
partition where your data has been located. Allow no further
writes. Afterwards, make yourself familiar with recovery tools.
Refer to the list archive and check out my older posts regarding
this topic (keywords: UFS recovery, fat fingers, undelete).
I lost lots of files, too - but I was able to recover them. Keep
in mind that "there is an app for this" and "one app fits all needs"
does not apply.
I will provide my "famous list" of recovery tools as a starting
fetch -rR <device>
dd_rescue <- use this to create images to work with
testdisk <- restores content
tsk <- The Sleuth Kit
Proprietary (free test version for diagnostics):
SysDev Laboratories LLC "UFS Explorer"
You usually will need to understand what you're doing. Read
"A Fast File System for UNIX" by M. K. McKusick. as a good
introduction. It helped me a lot.
You will then understand why "easy undeleting" of files and
directories is not possible by design. Blocks of deleted files
are marked "free", and they are not connected to any inodes
anymore. But as long as the blocks don't get overwritten, their
content will be there.
Probably TSK (The Sleuth Kit) is the way to go. In worst case,
it can recover anything. But try the "easier tools" like
photorec and magicrescue.
What you need to do depends on the kind of files you want to
If you're searching for specific files, using "grep" on the
disk device is possible as well; I once wrote an inefficient
and stupid script for that task. Just make sure you do not
cause any writes within the boundaries of the partition you
want to rescue from. Write to another disk partition, disk,
or USB media, or network. You can also make a copy of the
whole partition and work with that (as a file).
> /dev/da1p1 (ufs, local, journaled soft-updates)
Do not mount r/w where you want to recover from - the message
is missing the "read-only" element. Any writes may destroy your
data. Be very careful.
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...
More information about the freebsd-questions