Page 1 of 2 12 LastLast
Results 1 to 10 of 11

Thread: I did "rm *" and it's all gone

  1. #1
    Very good friend of the forum Virchanza's Avatar
    Join Date
    Jan 2010
    Posts
    863

    Default I did "rm *" and it's all gone

    I had a portable hard disk hooked up to my computer. The portable hard disk has two partitions:

    sdb1 : Filesystem = FAT32 : Contains big data files like movies and ISO images
    sdb2 : Filesystem = ext3 : This is a backup of my main Linux hard disk partition

    So anyway, I was at the command line, and I typed:

    Code:
    cd /mnt/sdb1
    rm tmp*
    ...or at least that's what I meant to type. Somehow, I managed to type a space before the asterisk, giving:

    Code:
    rm tmp *
    So after I did that, I typed:

    Code:
    ls
    and... well... nothing. Everything was all gone. Everything. Not a single file.

    My first thought would have been to pull the portable drive out of the USB slot immediately in the hope that the disk-write was cached and had yet to be written to disk... but that wasn't a viable option because I had sdb2 mounted at the same time and I could have lost important data.

    The stuff that was on sdb1 isn't particularly important, I mean it was pretty much just movies and ISO images I downloaded from the internet, I didn't lose any of my own files like documents or programming projects.

    So anyway, that happened about 3 weeks ago, and I haven't hooked the portable hard disk up to my computer since.

    After I did rm * , no further writes were made to the drive. As soon as I realised everything had been deleted, I just dismounted the drive normally using "umount" and then I pulled out the USB plug... so I reckon there's high chances of recovery.

    Is there anyone here with experience in recovering data from a FAT32 partition, data that was deleted by "rm" in Linux? Can you please talk me thru it, tell me what's the best program to use. By the way, I can boot up MS-Windows XP if need be (and of course I can also boot up Linux).

    Oh yes, and I'm a retard. I'm gonna slow down the next time I use the "rm" command... or I might just use Konqueror.
    Ask questions on the open forums, that way everybody benefits from the solution, and everybody can be corrected when they make mistakes. Don't send me private messages asking questions that should be asked on the open forums, I won't respond. I decline all "Friend Requests".

  2. #2
    Senior Member
    Join Date
    Aug 2007
    Posts
    916

    Default

    There are recovery programs like sleuth-kit which may help but its a painful process because you have to image the entire disk or partition first before you can actually make use of the programs.

    I have used it once only to recover data from a dying flash media only to find that the image contained previously deleted files but not any new files that were being added to the flash media.

  3. #3
    Very good friend of the forum Virchanza's Avatar
    Join Date
    Jan 2010
    Posts
    863

    Default

    Thanks for the reply Hatake.

    The last time I recovered deleted data was about 15 years ago back when I using MS-DOS. I remember it was as easy as opening an "undelete" program, letting it scan the disk, and then selecting the files you wanted to "undelete".

    In the meantime I'll just hang around and wait to see if there's someone here that has boat loads of experience with doing this. . .
    Ask questions on the open forums, that way everybody benefits from the solution, and everybody can be corrected when they make mistakes. Don't send me private messages asking questions that should be asked on the open forums, I won't respond. I decline all "Friend Requests".

  4. #4
    Very good friend of the forum TAPE's Avatar
    Join Date
    Jan 2010
    Location
    Europe
    Posts
    599

    Default

    No boat-loads of experience from me, the only time I have done this was on a Windows drive, using Windows software.

    Out of interest though, have you tried using windows and file recovery software ? I had pretty good results using the freely available software out there (think it was scavenger, or undelete, cant remember) although I was looking for a certain file, so I knew the file size to look for etc.

    Not sure how it would work for complete restoration of files on an entire drive.

    Would be interested to see how you progress.

  5. #5
    Very good friend of the forum Gitsnik's Avatar
    Join Date
    Jan 2010
    Location
    The Crystal Wind
    Posts
    851

    Default

    Quote Originally Posted by hatake_kakashi View Post
    because you have to image the entire disk or partition first before you can actually make use of the programs.
    You should always
    Code:
    dd if=/dev/hdb1 of=backup_usbdrive.img
    Before you do anything like this just in case.

    Anyway Foremost has been good to me. Of course if you have a Windows box around (likely considering the choice of movie drive!) just grab a copy of WinHEX (or whatever tool you like, I just really like winhex), and retrieve them that way.

    rm doesn't shred the files, so it's a case of restoring the link count (or however it is FAT does it). You should be able to get most of the data back.

    By the way, rdiff-backup: Main :P
    Still not underestimating the power...

    There is no such thing as bad information - There is truth in the data, so you sift it all, even the crap stuff.

  6. #6
    Member PeppersGhost's Avatar
    Join Date
    Jan 2008
    Posts
    204

    Default

    Oh Virchanza, silly boy. Not to worry friend, there are hundreds of free progs for this. My old work buddy left his hooked up to the corp network once overnight. Next day 4 years worth of movies, and what not gone. Apparently corp scan found it and extreme failed it. He recovered all very quickly.
    Many good *nix recovery tools as well. Good luck on recovery.
    <EeePc 1000HA BT4/W7 USB boot Alfa500 GPS BlueTooth>

  7. #7
    Very good friend of the forum drgr33n's Avatar
    Join Date
    Jan 2010
    Location
    Dark side of the moon ...
    Posts
    699

    Default

    testdisk is the best recovery application I've used on *nux. Got me out of a few bad situations

    TestDisk - CGSecurity

  8. #8
    Very good friend of the forum Virchanza's Avatar
    Join Date
    Jan 2010
    Posts
    863

    Default

    I just realised I have a repressed memory. . . I remember a few years ago I tried downloading "undelete" programs and I must have downloaded and tried 5 different programs... and none of them did the job... it was a PAIN IN THE ASS.

    Anyone know what the best software is for undeleting files on a FAT32 partition?
    Ask questions on the open forums, that way everybody benefits from the solution, and everybody can be corrected when they make mistakes. Don't send me private messages asking questions that should be asked on the open forums, I won't respond. I decline all "Friend Requests".

  9. #9
    Very good friend of the forum Virchanza's Avatar
    Join Date
    Jan 2010
    Posts
    863

    Default

    I hooked up the external hard disk to my computer just there and it turns out that the partition that had all its stuff deleted is actually NTFS! I could have sworn it was FAT32. I've no idea why I would have created an NTFS partition for storing movies and ISO images???

    So anyway, how should I go about recovering data from an NTFS?
    Ask questions on the open forums, that way everybody benefits from the solution, and everybody can be corrected when they make mistakes. Don't send me private messages asking questions that should be asked on the open forums, I won't respond. I decline all "Friend Requests".

  10. #10
    Super Moderator lupin's Avatar
    Join Date
    Jan 2010
    Posts
    2,943

    Default

    Quote Originally Posted by Virchanza View Post
    I hooked up the external hard disk to my computer just there and it turns out that the partition that had all its stuff deleted is actually NTFS! I could have sworn it was FAT32. I've no idea why I would have created an NTFS partition for storing movies and ISO images???

    So anyway, how should I go about recovering data from an NTFS?
    I have had luck with both NTFSUndelete and the Sleuth Kit. IIRC there is a Sleuth Kit Informer article that goes over what each of the different tools does if you need a pointer in the right direction.

    Also you may want to check this out:

    https://help.ubuntu.com/community/DataRecovery
    Capitalisation is important. It's the difference between "Helping your brother Jack off a horse" and "Helping your brother jack off a horse".

    The Forum Rules, Forum FAQ and the BackTrack Wiki... learn them, love them, live them.

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •