Page 1 of 2 12 LastLast
Results 1 to 10 of 18

Thread: Question about data recovery

  1. #1

    Default Question about data recovery

    Okay, here's the deal: I have separate partitions for root and home and a big ntfs partition for data ~700GB. The data partition is mounted to a directory "data" in my users' home directories. Recently I deleted a user and used the option in YAST to remove their home directory. YAST apparently deleted my entire data partition as well. This is pretty catastrophic for me, not all of that data was backed up, so I'm wondering if anyone can suggest a method to get that back. I haven't written anything to that partition so presumably it should all still be there.

  2. #2
    Join Date
    Jun 2008
    Location
    West Yorkshire, UK
    Posts
    3,500

    Default Re: Question about data recovery

    First of all, don't do anything more to the partition as your files are still likely to be there. If possible, use dd to copy the data partition to a USB hard drive and then try to recover the lost files.

    The Live CD from Download - SystemRescueCd offers a comprehensive suite of programs for recovering files. Being a live CD, it won't write anything new to your system.

    Obviously, downloading and creating the System Rescue Live CD on a friend's computer prevents any overwriting of important data on your system.
    Last edited by john_hudson; 26-Mar-2012 at 00:38. Reason: Additional information

  3. #3
    Join Date
    Jun 2008
    Location
    Netherlands
    Posts
    25,972

    Default Re: Question about data recovery

    As an addition to the excelent advice above: as it all happened on a non-Linux file system, wouldn't it be better to try the recovery on a native NTFS system (some Windows). I guess there are more tools dedicated to this task available there.
    Henk van Velden

  4. #4
    Join Date
    Mar 2008
    Location
    Oz
    Posts
    11,729
    Blog Entries
    2

    Default Re: Question about data recovery

    the ntfs-3g suite is installed on your Linux computer. It contains a sub-suite called ntfsprogs. One of the apps in ntfsprogs is called ntfsundelete. Run the man page and have a look around in there: man ntfsundelete
    You can run this inside openSUSE already.
    Leap 42.3 & 15.1 &KDE
    FYIs from the days of yore

  5. #5

    Default Re: Question about data recovery

    Quote Originally Posted by hcvv View Post
    As an addition to the excelent advice above: as it all happened on a non-Linux file system, wouldn't it be better to try the recovery on a native NTFS system (some Windows). I guess there are more tools dedicated to this task available there.
    I'd be happy to try whatever on whichever platform, but I don't know of any appropriate utilities.

    It looks like SystemRescueCD has a utility called TestDisk which will allow deleted files to be copied over to another disk or partition. The Ultimate Boot CD has a similar utility (another disk I had lying around) and it looks like ntfsundelete does the same thing. But I don't have a 700 GB disk or partition - I need to recover the files in place. Or at least that would be the best method. Is that an option?

    Secondary question: Is the directory structure of that partition lost? All of the utilities are just listing the files in alphabetical order, which is nuts. There are thousands of files. A graphical utility that would let me go through the directory tree would be really handy here.

  6. #6
    Join Date
    Jun 2008
    Location
    Netherlands
    Posts
    25,972

    Default Re: Question about data recovery

    Quote Originally Posted by shmuck View Post
    I'd be happy to try whatever on whichever platform, but I don't know of any appropriate utilities.

    It looks like SystemRescueCD has a utility called TestDisk which will allow deleted files to be copied over to another disk or partition. The Ultimate Boot CD has a similar utility (another disk I had lying around) and it looks like ntfsundelete does the same thing. But I don't have a 700 GB disk or partition - I need to recover the files in place. Or at least that would be the best method. Is that an option?
    Be carefull, for every pure Linux tool you must be sure that it works for a non-Linux file system type like NTFS.

    My idea is that you should look into @swerdna's post. He points you to a NTFS dedicated tool running on Linux.
    Henk van Velden

  7. #7
    Join Date
    Feb 2009
    Location
    Spain
    Posts
    25,547

    Default Re: Question about data recovery

    On 2012-03-26 11:36, shmuck wrote:
    > I need to recover the files in place. Or at
    > least that would be the best method. Is that an option?


    Not advisable, unless you find a Windows util that does.

    --
    Cheers / Saludos,

    Carlos E. R.
    (from 11.4 x86_64 "Celadon" at Telcontar)

  8. #8

    Default Re: Question about data recovery

    All right, I'm still working on this so let me ask a follow-up question: I found a server with some large-capacity storage and decided to use dd to make a copy of the partition before trying anything further. Was thinking that I could boot into Windows at that point and try undeleting in place, with the backup available in case something went wrong.

    So I've been running dd for the last 24 hours just using the command: "dd if=[partition] of=[target]" and it looks like it's only done 40 GB so far. At this rate it's going to take about 18 days and that just... I can't understand why this is taking so long. Maybe I've made a poor choice? Is there any way to speed this up?

  9. #9
    Join Date
    Jun 2008
    Location
    San Diego, Ca, USA
    Posts
    12,069
    Blog Entries
    2

    Default Re: Question about data recovery

    I haven't refreshed my knowledge for a year plus now on what software is available but I recommend you do a search and evaluation of forensics software. There should be free suites and commercial suites which can be very expensive. In general, a forensics suite will provide ready tools for disk imaging, disk inspection, file recovery and file inspection. Note that when you're running a suite, the tools and components are tested and validated to work well and reliably unlike simply trying to install a package that <should> work.

    Beware mounting disks on Windows OS (even native Windows FS), it's well known that all Windows OS will write a disk identifier... That is why you won't find any forensics suites running on Windows... only *NIX. Usually this won't cause an issue, but ordinarily when you want to recover data you really don't want to write <anything> to the disk.

    HTH,
    TS

  10. #10
    Join Date
    Feb 2009
    Location
    Spain
    Posts
    25,547

    Default Re: Question about data recovery

    On 2012-03-28 23:56, shmuck wrote:
    >
    > All right, I'm still working on this so let me ask a follow-up question:
    > I found a server with some large-capacity storage and decided to use dd
    > to make a copy of the partition before trying anything further. Was
    > thinking that I could boot into Windows at that point and try undeleting
    > in place, with the backup available in case something went wrong.
    >
    > So I've been running dd for the last 24 hours just using the command:
    > "dd if=[partition] of=[target]" and it looks like it's only done 40 GB
    > so far. At this rate it's going to take about 18 days and that just... I
    > can't understand why this is taking so long. Maybe I've made a poor
    > choice? Is there any way to speed this up?


    Let me see if I understood. You plugged the problem disk into another
    computer (directly?). Lets say this is disk /dev/sdY, and the local disk is
    /dev/sdX. You are running:

    Code:
    dd if=/dev/sdYn of=somefile_in_sdX
    Is that it? And it is running very slowly. How many gigabytes per minute?
    Ah, 40/(24*60)= 27MB/min. Wow.

    The cause could be (if the connection is direct) read or write errors on
    one of the disks.

    --
    Cheers / Saludos,

    Carlos E. R.
    (from 11.4 x86_64 "Celadon" at Telcontar)

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •