I’ve been spoiled by the advance in Linux desktop environments. I bought a large 3 TB external harddrive and made a backup of my /home directory into a tarball. I re-installed OpenSuSE on my shiny new SSD, updated it, moved it to Tumbleweed - all was nice. Boots in a blink! So I plugged in my external HD…and I screwed up the flags on the tar command. I wrote over my backup file. The compressed tar file was like 200 or 300 gb, now it was a tiny 5 mb file. >:(
I understand that when you delete a file it doesn’t actually go away, the vast majority of the tar file is still on that hard drive - its just unaccessible at the moment. I’m aware of Windows tools to attempt to recover the file but I’ve never run into this situation on a Linux or BSD system before. Anyone have any suggestions? Oh, the filesystem on both my new SSD and the external HD is Ext4. Whatever the normal settings are that OpenSuSE uses.
> So I plugged in my external HD…and I screwed up the flags on the
> tar command. I wrote over my backup file.
Oh, my.
> The compressed tar file
> was like 200 or 300 gb, now it was a tiny 5 mb file. >:(
> I understand that when you delete a file it doesn’t actually go away,
> the vast majority of the tar file is still on that hard drive - its just
> unaccessible at the moment.
Forget it.
A deleted file might remain. An overwritten file, not. If what you had
was a compressed tar archive, a single byte damaged on the compressed
stream makes it totally unrecoverable. You’d have to recover somehow the
original tar.gz archive exactly as it was, undamaged, to be able to open it.
> I’m aware of Windows tools to attempt to
> recover the file but I’ve never run into this situation on a Linux or
> BSD system before.
Tools like that search for known file types with a known structure, like
a jpeg file, and have a good success rate with them. This is what
photorec does.
> Anyone have any suggestions? Oh, the filesystem on
> both my new SSD and the external HD is Ext4. Whatever the normal
> settings are that OpenSuSE uses.
PhotoRec http://www.cgsecurity.org/wiki/PhotoRec
foremost http://foremost.sourceforge.net/
http://en.wikipedia.org/wiki/Foremost_(software)
Foremost is a forensic data recovery program for
Linux used to recover files using their headers,
footers, and data structures through
a process known as file carving.[3] Although written
for law enforcement use, it is freely available and can
be used as a general data recovery tool.[2]
ext4magic
****. Oh well, thanks. Much of those files I had on my desktop - not a total loss. But still. Gotta double and triple check those flags before ya hit enter.
On 2014-02-09 15:56, red unix addict wrote:
>
> ****. Oh well, thanks. Much of those files I had on my desktop - not a
> total loss. But still. Gotta double and triple check those flags
> before ya hit enter.
You can try ext4magic. As long as you don’t write anything on that
filesystem…
And, perhaps in future, keep 3 separate backups in 3 separate places: One for when it gets “borked”, a 2nd one that gets “double-borked” in your sudden panic, and – after a deep breathe and a pause – a 3rd backup to finally save your “bortt”.
I have in the past hit the 3rd-copy recovery stage on occasion. :O>:(:’(
So I plugged in my external HD…and I screwed up the flags on the tar command. I wrote over my backup file. The compressed tar file was like 200 or 300 gb, now it was a tiny 5 mb file. >:(