Results 1 to 5 of 5

Thread: Borked my Backup

  1. #1

    Angry Borked my Backup

    I've been spoiled by the advance in Linux desktop environments. I bought a large 3 TB external harddrive and made a backup of my /home directory into a tarball. I re-installed OpenSuSE on my shiny new SSD, updated it, moved it to Tumbleweed - all was nice. Boots in a blink! So I plugged in my external HD...and I screwed up the flags on the tar command. I wrote *over* my backup file. The compressed tar file was like 200 or 300 gb, now it was a tiny 5 mb file.
    I understand that when you delete a file it doesn't actually go away, the vast majority of the tar file is still on that hard drive - its just unaccessible at the moment. I'm aware of Windows tools to attempt to recover the file but I've never run into this situation on a Linux or BSD system before. Anyone have any suggestions? Oh, the filesystem on both my new SSD and the external HD is Ext4. Whatever the normal settings are that OpenSuSE uses.

    Any help would be greatly appreciated!

  2. #2
    Join Date
    Feb 2009
    Location
    Spain
    Posts
    25,547

    Default Re: Borked my Backup

    On 2014-02-09 12:56, red unix addict wrote:


    > So I plugged in my external HD...and I screwed up the flags on the
    > tar command. I wrote *over* my backup file.


    Oh, my.

    > The compressed tar file
    > was like 200 or 300 gb, now it was a tiny 5 mb file.
    > I understand that when you delete a file it doesn't actually go away,
    > the vast majority of the tar file is still on that hard drive - its just
    > unaccessible at the moment.


    Forget it. :-(

    A deleted file might remain. An overwritten file, not. If what you had
    was a compressed tar archive, a single byte damaged on the compressed
    stream makes it totally unrecoverable. You'd have to recover somehow the
    original tar.gz archive exactly as it was, undamaged, to be able to open it.

    > I'm aware of Windows tools to attempt to
    > recover the file but I've never run into this situation on a Linux or
    > BSD system before.


    Tools like that search for known file types with a known structure, like
    a jpeg file, and have a good success rate with them. This is what
    photorec does.

    > Anyone have any suggestions? Oh, the filesystem on
    > both my new SSD and the external HD is Ext4. Whatever the normal
    > settings are that OpenSuSE uses.



    Code:
    PhotoRec        http://www.cgsecurity.org/wiki/PhotoRec
    
    foremost        http://foremost.sourceforge.net/
    http://en.wikipedia.org/wiki/Foremost_(software)
    
    Foremost is a forensic data recovery program for
    Linux used to recover files using their headers,
    footers,  and data structures through
    a process known as file carving.[3] Although written
    for law enforcement use, it is freely available and can
    be used as a general data recovery tool.[2]
    
    ext4magic
    I'd suggest to start with the last one.

    --
    Cheers / Saludos,

    Carlos E. R.

    (from 13.1 x86_64 "Bottle" (Minas Tirith))

  3. #3

    Default Re: Borked my Backup

    ****. Oh well, thanks. Much of those files I had on my desktop - not a total loss. But still. Gotta double and triple check those flags before ya hit enter. :-)

    Thanks again,
    ~Christopher


    Quote Originally Posted by robin_listas View Post
    On 2014-02-09 12:56, red unix addict wrote:


    > So I plugged in my external HD...and I screwed up the flags on the
    > tar command. I wrote *over* my backup file.


    Oh, my.

    > The compressed tar file
    > was like 200 or 300 gb, now it was a tiny 5 mb file.
    > I understand that when you delete a file it doesn't actually go away,
    > the vast majority of the tar file is still on that hard drive - its just
    > unaccessible at the moment.


    Forget it. :-(

    A deleted file might remain. An overwritten file, not. If what you had
    was a compressed tar archive, a single byte damaged on the compressed
    stream makes it totally unrecoverable. You'd have to recover somehow the
    original tar.gz archive exactly as it was, undamaged, to be able to open it.

    > I'm aware of Windows tools to attempt to
    > recover the file but I've never run into this situation on a Linux or
    > BSD system before.


    Tools like that search for known file types with a known structure, like
    a jpeg file, and have a good success rate with them. This is what
    photorec does.

    > Anyone have any suggestions? Oh, the filesystem on
    > both my new SSD and the external HD is Ext4. Whatever the normal
    > settings are that OpenSuSE uses.



    Code:
    PhotoRec        http://www.cgsecurity.org/wiki/PhotoRec
    
    foremost        http://foremost.sourceforge.net/
    http://en.wikipedia.org/wiki/Foremost_(software)
    
    Foremost is a forensic data recovery program for
    Linux used to recover files using their headers,
    footers,  and data structures through
    a process known as file carving.[3] Although written
    for law enforcement use, it is freely available and can
    be used as a general data recovery tool.[2]
    
    ext4magic
    I'd suggest to start with the last one.

    --
    Cheers / Saludos,

    Carlos E. R.

    (from 13.1 x86_64 "Bottle" (Minas Tirith))

  4. #4
    Join Date
    Feb 2009
    Location
    Spain
    Posts
    25,547

    Default Re: Borked my Backup

    On 2014-02-09 15:56, red unix addict wrote:
    >
    > ****. Oh well, thanks. Much of those files I had on my desktop - not a
    > total loss. But still. Gotta double and triple check those flags
    > before ya hit enter. :-)


    You can try ext4magic. As long as you don't write anything on that
    filesystem...

    --
    Cheers / Saludos,

    Carlos E. R.

    (from 13.1 x86_64 "Bottle" (Minas Tirith))

  5. #5
    Join Date
    Nov 2013
    Location
    Kamloops, BC, Canada
    Posts
    4,029

    Default Re: Borked my Backup

    Quote Originally Posted by red_unix_addict View Post
    ****. Oh well, thanks. Much of those files I had on my desktop - not a total loss. But still. Gotta double and triple check those flags before ya hit enter. :-)

    Thanks again,
    ~Christopher
    Yep.

    And, perhaps in future, keep 3 separate backups in 3 separate places: One for when it gets "borked", a 2nd one that gets "double-borked" in your sudden panic, and -- after a deep breathe and a pause -- a 3rd backup to finally save your "bortt".

    I have in the past hit the 3rd-copy recovery stage on occasion.
    "Take a Walk on a Sunny Day, Greet everyone along the way, and Make Somebody Smile, Today"
    Gerry Jack Macks"Walk On A Sunny Day" GerryJackMacks.net

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •