I did "rm *" and it's all gone

I had a portable hard disk hooked up to my computer. The portable hard disk has two partitions:

sdb1 : Filesystem = FAT32 : Contains big data files like movies and ISO images
sdb2 : Filesystem = ext3 : This is a backup of my main Linux hard disk partition

So anyway, I was at the command line, and I typed:

Code:

---

cd /mnt/sdb1
rm tmp*

---

...or at least that's what I meant to type. Somehow, I managed to type a space before the asterisk, giving:

Code:

---

rm tmp *

---

So after I did that, I typed:

Code:

---

ls

---

and... well... nothing. Everything was all gone. Everything. Not a single file.

My first thought would have been to pull the portable drive out of the USB slot immediately in the hope that the disk-write was cached and had yet to be written to disk... but that wasn't a viable option because I had sdb2 mounted at the same time and I could have lost important data.

The stuff that was on sdb1 isn't particularly important, I mean it was pretty much just movies and ISO images I downloaded from the internet, I didn't lose any of my own files like documents or programming projects.

So anyway, that happened about 3 weeks ago, and I haven't hooked the portable hard disk up to my computer since.

After I did rm * , no further writes were made to the drive. As soon as I realised everything had been deleted, I just dismounted the drive normally using "umount" and then I pulled out the USB plug... so I reckon there's high chances of recovery.

Is there anyone here with experience in recovering data from a FAT32 partition, data that was deleted by "rm" in Linux? Can you please talk me thru it, tell me what's the best program to use. By the way, I can boot up MS-Windows XP if need be (and of course I can also boot up Linux).

Oh yes, and I'm a retard. I'm gonna slow down the next time I use the "rm" command... or I might just use Konqueror.

There are recovery programs like sleuth-kit which may help but its a painful process because you have to image the entire disk or partition first before you can actually make use of the programs.

I have used it once only to recover data from a dying flash media only to find that the image contained previously deleted files but not any new files that were being added to the flash media.

Thanks for the reply Hatake.

The last time I recovered deleted data was about 15 years ago back when I using MS-DOS. I remember it was as easy as opening an "undelete" program, letting it scan the disk, and then selecting the files you wanted to "undelete".

In the meantime I'll just hang around and wait to see if there's someone here that has boat loads of experience with doing this. . .

No boat-loads of experience from me, the only time I have done this was on a Windows drive, using Windows software.

Out of interest though, have you tried using windows and file recovery software ? I had pretty good results using the freely available software out there (think it was scavenger, or undelete, cant remember) although I was looking for a certain file, so I knew the file size to look for etc.

Not sure how it would work for complete restoration of files on an entire drive.

Would be interested to see how you progress.

Quote:

---

Originally Posted by hatake_kakashi

because you have to image the entire disk or partition first before you can actually make use of the programs.

---

You should always

Code:

---

dd if=/dev/hdb1 of=backup_usbdrive.img

---

Before you do anything like this just in case.

Anyway Foremost has been good to me. Of course if you have a Windows box around (likely considering the choice of movie drive!) just grab a copy of WinHEX (or whatever tool you like, I just really like winhex), and retrieve them that way.

rm doesn't shred the files, so it's a case of restoring the link count (or however it is FAT does it). You should be able to get most of the data back.

By the way, rdiff-backup: Main :P

Oh Virchanza, silly boy. Not to worry friend, there are hundreds of free progs for this. My old work buddy left his hooked up to the corp network once overnight. Next day 4 years worth of movies, and what not gone. Apparently corp scan found it and extreme failed it. He recovered all very quickly.
Many good *nix recovery tools as well. Good luck on recovery.

testdisk is the best recovery application I've used on *nux. Got me out of a few bad situations ;)

TestDisk - CGSecurity

I just realised I have a repressed memory. . . I remember a few years ago I tried downloading "undelete" programs and I must have downloaded and tried 5 different programs... and none of them did the job... it was a PAIN IN THE ASS.

Anyone know what the best software is for undeleting files on a FAT32 partition?

I hooked up the external hard disk to my computer just there and it turns out that the partition that had all its stuff deleted is actually NTFS! I could have sworn it was FAT32. I've no idea why I would have created an NTFS partition for storing movies and ISO images???

So anyway, how should I go about recovering data from an NTFS?

Quote:

---

Originally Posted by Virchanza

I hooked up the external hard disk to my computer just there and it turns out that the partition that had all its stuff deleted is actually NTFS! I could have sworn it was FAT32. I've no idea why I would have created an NTFS partition for storing movies and ISO images???

So anyway, how should I go about recovering data from an NTFS?

---

I have had luck with both NTFSUndelete and the Sleuth Kit. IIRC there is a Sleuth Kit Informer article that goes over what each of the different tools does if you need a pointer in the right direction.

Also you may want to check this out:

https://help.ubuntu.com/community/DataRecovery