I did "rm *" and it's all gone
I had a portable hard disk hooked up to my computer. The portable hard disk has two partitions:
sdb1 : Filesystem = FAT32 : Contains big data files like movies and ISO images
sdb2 : Filesystem = ext3 : This is a backup of my main Linux hard disk partition
So anyway, I was at the command line, and I typed:
...or at least that's what I meant to type. Somehow, I managed to type a space before the asterisk, giving:Code:cd /mnt/sdb1 rm tmp*
So after I did that, I typed:Code:rm tmp *
and... well... nothing. Everything was all gone. Everything. Not a single file.Code:ls
My first thought would have been to pull the portable drive out of the USB slot immediately in the hope that the disk-write was cached and had yet to be written to disk... but that wasn't a viable option because I had sdb2 mounted at the same time and I could have lost important data.
The stuff that was on sdb1 isn't particularly important, I mean it was pretty much just movies and ISO images I downloaded from the internet, I didn't lose any of my own files like documents or programming projects.
So anyway, that happened about 3 weeks ago, and I haven't hooked the portable hard disk up to my computer since.
After I did rm * , no further writes were made to the drive. As soon as I realised everything had been deleted, I just dismounted the drive normally using "umount" and then I pulled out the USB plug... so I reckon there's high chances of recovery.
Is there anyone here with experience in recovering data from a FAT32 partition, data that was deleted by "rm" in Linux? Can you please talk me thru it, tell me what's the best program to use. By the way, I can boot up MS-Windows XP if need be (and of course I can also boot up Linux).
Oh yes, and I'm a retard. I'm gonna slow down the next time I use the "rm" command... or I might just use Konqueror.
Ask questions on the open forums, that way everybody benefits from the solution, and everybody can be corrected when they make mistakes. Don't send me private messages asking questions that should be asked on the open forums, I won't respond. I decline all "Friend Requests".
There are recovery programs like sleuth-kit which may help but its a painful process because you have to image the entire disk or partition first before you can actually make use of the programs.
I have used it once only to recover data from a dying flash media only to find that the image contained previously deleted files but not any new files that were being added to the flash media.
Thanks for the reply Hatake.
The last time I recovered deleted data was about 15 years ago back when I using MS-DOS. I remember it was as easy as opening an "undelete" program, letting it scan the disk, and then selecting the files you wanted to "undelete".
In the meantime I'll just hang around and wait to see if there's someone here that has boat loads of experience with doing this. . .
Ask questions on the open forums, that way everybody benefits from the solution, and everybody can be corrected when they make mistakes. Don't send me private messages asking questions that should be asked on the open forums, I won't respond. I decline all "Friend Requests".
No boat-loads of experience from me, the only time I have done this was on a Windows drive, using Windows software.
Out of interest though, have you tried using windows and file recovery software ? I had pretty good results using the freely available software out there (think it was scavenger, or undelete, cant remember) although I was looking for a certain file, so I knew the file size to look for etc.
Not sure how it would work for complete restoration of files on an entire drive.
Would be interested to see how you progress.
You should alwaysOriginally Posted by hatake_kakashi
Before you do anything like this just in case.Code:dd if=/dev/hdb1 of=backup_usbdrive.img
Anyway Foremost has been good to me. Of course if you have a Windows box around (likely considering the choice of movie drive!) just grab a copy of WinHEX (or whatever tool you like, I just really like winhex), and retrieve them that way.
rm doesn't shred the files, so it's a case of restoring the link count (or however it is FAT does it). You should be able to get most of the data back.
By the way, rdiff-backup: Main :P
Still not underestimating the power...
There is no such thing as bad information - There is truth in the data, so you sift it all, even the crap stuff.
Oh Virchanza, silly boy. Not to worry friend, there are hundreds of free progs for this. My old work buddy left his hooked up to the corp network once overnight. Next day 4 years worth of movies, and what not gone. Apparently corp scan found it and extreme failed it. He recovered all very quickly.
Many good *nix recovery tools as well. Good luck on recovery.
<EeePc 1000HA BT4/W7 USB boot Alfa500 GPS BlueTooth>
testdisk is the best recovery application I've used on *nux. Got me out of a few bad situations
TestDisk - CGSecurity
I just realised I have a repressed memory. . . I remember a few years ago I tried downloading "undelete" programs and I must have downloaded and tried 5 different programs... and none of them did the job... it was a PAIN IN THE ASS.
Anyone know what the best software is for undeleting files on a FAT32 partition?
Ask questions on the open forums, that way everybody benefits from the solution, and everybody can be corrected when they make mistakes. Don't send me private messages asking questions that should be asked on the open forums, I won't respond. I decline all "Friend Requests".
I hooked up the external hard disk to my computer just there and it turns out that the partition that had all its stuff deleted is actually NTFS! I could have sworn it was FAT32. I've no idea why I would have created an NTFS partition for storing movies and ISO images???
So anyway, how should I go about recovering data from an NTFS?
Ask questions on the open forums, that way everybody benefits from the solution, and everybody can be corrected when they make mistakes. Don't send me private messages asking questions that should be asked on the open forums, I won't respond. I decline all "Friend Requests".
I have had luck with both NTFSUndelete and the Sleuth Kit. IIRC there is a Sleuth Kit Informer article that goes over what each of the different tools does if you need a pointer in the right direction.
Also you may want to check this out:
https://help.ubuntu.com/community/DataRecovery
Capitalisation is important. It's the difference between "Helping your brother Jack off a horse" and "Helping your brother jack off a horse".
The Forum Rules, Forum FAQ and the BackTrack Wiki... learn them, love them, live them.
Posting Permissions
