How to? - giis-ext4 -For recovering a file

Hoping someone can provide some guidance, peculiarly as useful as this tool would be if it works, I can’t seem to find any tutorials or cookbooks that clearly describe its usage and IMO it’s not that intuitive.

Running on
openSUSE 11.3 with a fairly standard partitioning and format (ie ext4)

I suspect though that the OS makes no diff, the same binaries likely would be used on any ext4 system.

This is what has been done so far…

  1. (After verifying that EXt4 is the target partition’s format) Install giis-ext4 package

  2. At this point I’ve found that you can’t just execute the app (ie giis-ext4 --recover), you first need to build a database of recoverable files by executing the following first

  3. I’ve run the following first as the local non-root User which returned an error saying insufficient permissions to build a database, then as root


# giis-ext4 --install

  1. That seems to successfully start to build the file recovery database returning the following

 giis-ext4:Installation begins..
 giis-ext4: header table created
 giis-ext4: file table created
 What's the maximum directory depth?

  1. I chose a depth of 3, then

 Enter the dirname name,that you would like to protect(Max. 7 directories)

  1. I assume that this means to exclude various directory trees. The target directory is a subdirectory in “/home” but I assume this question should primarily reference the system root. In any case, I chose to “protect”

/boot
/root

  1. After defining the protected directories, the following was asked
 Check for newly files every 'auto update time' minutes.
  1. I fairly arbitrarily chose 10 although I’m not actively doing anything else other than attempting to recover any recoverable files.

That results in the application parsing a number of directories, listing /boot and /root (directories I specified should be excluded) as well as directories which included where I hoped recoverable files were located.

After the parsed directories, the following was written

 *Please add following entry into your /etc/crontab file for auto update
 */10 * * * * root /usr/bin/giis-ext4 -u > /dev/null 
 giis-ext4:Installation is complete.

I don’t believe the first part should be important, only that the “installation is complete” which I interpret as likely successful to this point.

Assuming that building the database of recoverable files was successful, I then attempted a “giis-ext4 --recovery” two different ways but instead returned the following and am not sure how to proceed

10a First Attempt to recover by date


 Device Found : /dev/sda2
 press 1: get all user files
 press 2: get specific user files
 press 3: get specific file type
 press 4: get specific file
 press 5: get it by deleted date
 Enter your option:5


Get Files by Deleted Date:
        Press 0 : Deleted on
        Press 1 : Deleted After
        Press 2 : Deleted Before 
        Press 3 : Deleted Between

                Enter Your Choice :0

 Enter date1: DD MM YYYY :08:10:2011

 Please Enter Valid Date.: Success

Success, but what then? If it means that files should re-appear in their original locations, that didn’t happen… And there doesn’t seem to be a clue what to do next

10b. Second Attempt to recover by listing all files


 Device Found : /dev/sda2
 press 1: get all user files
 press 2: get specific user files
 press 3: get specific file type
 press 4: get specific file
 press 5: get it by deleted date
 Enter your option:1

 Verifing inode:795127|813055|791014|791017|791013|791020|791021|138671|791019|794533|791011|791018|791010|814245|791012|834810|791015|791016|820415|820363|820604|820589|820576|820574|820635|820361|820484|820367|820350|820378|820349|820547|820381|820373|820577|820517|820631|820374|820585|820483|820369|820630|

 **giis-ext4 : Recovery completed.Please check /usr/local/giis/giis.log for more details and /usr/local/giis/got_it/ for files **


Well, that’s interesting. It looks like plenty of files might have been identified by inode, but what to do next? The directory /usr/local/giis is empty so there is no logfile and no “got_it” directory which I speculate might contain either the inode numbers which were just printed to screen or <maybe> friendly file names.

TIA if someone can take me to the next and possibly conclusive step, or have I run into a bug because I really do need the contents of /usr/local/giis

Tony

Unfortunately you can’t use giis to recover files that were deleted before it was installed. It can only recover files deleted from protected directories after the protection is set up. You may have more success with “photorec”. Don’t be misled by the name, it can recovery all sorts of files. I used it to successfully recover a bunch of emails. Good luck.

Hi -
giis-ext4 was written by me.As oakhillj mentioned - giis can’t recover files deleted before it was installed. (more here gET iT i sAY, giis - ext3 File Undelete Tool)
Few months back I posted HowTo on linux.com - (https://www.linux.com/community/blogs/133-general-linux/421573-ext4-file-recovery-with-giis-ext4)

since giis-ext4 is very much similar to giis (supports ext2,ext3) so I thought user guide + screenshot provided here gET iT i sAY, giis - ext3 File Undelete Tool was enough.

In case you already deleted files from ext4 (giis-ext4 won’t be useful) ,then I agree photorec is a good tool. If your journal entries not lost then extundelete: An ext3 and ext4 file undeletion utility may be helpful. And recently I have updated a tool named extcarve (Index of /giis) which is similar to foremost.
HowTo Old Nabble - Ext3 - User - extcarve - ext2,ext3,ext4 file carving tool (extcarve helped the user on that thread to recover some of his files)
extcarve | freshmeat.net
Ps: Don’t install anything on your affected partition - do umount it as soon as possible.

Cool,
Thx guys for your posts.

The file that led me on this investigation isn’t critically important but as this thread suggests is a topic best covered and understood, maybe even with software pre-installed and configured before you really need it.

Tony

On 10/19/2011 09:56 PM, lakshmipathig wrote:
> giis-ext4 was written by me

thanks for writing it, and BIG THANKS for coming by here to help out!!

your contributions to open source software are appreciated by all!


DD
openSUSE®, the “German Automobiles” of operating systems

I think it’s my duty to help out. :slight_smile:

your contributions to open source software are appreciated by all!

Thanks a lot ,I’m so happy to hear that :slight_smile: :slight_smile: Open source community had given me a lot and I wanted to give something back.

On 10/20/2011 10:36 AM, lakshmipathig wrote:
>
> Thanks a lot ,I’m so happy to hear that :slight_smile: :slight_smile: Open source community had
> given me a lot and I wanted to give something back.

be proud that you gave so much…installing and setting up giis is on my
list of stuff to get done today!!

wish we had more givers at your level of capability…on the other hand
i also appreciate those who wander in here five minutes after their
first install attempt

if would be nice if the transition were easier…but . . .


DD
http://tinyurl.com/DD-Caveat
http://tinyurl.com/DD-Hardware
http://tinyurl.com/DD-Software
openSUSE®, the “German Automobiles” of operating systems

Thanks, sure there is also a screencasting available on above mentioned url.If you face any issue,just let me know :slight_smile:

???

Today, giis-ext4 is nowhere to be found in the repositories?
Am still testing, but It seems to be a really nice, small and lightweight way to do file recovery…

Am hoping it’s a temporary thing, not something permanent.

Also, if not too much trouble would like to see the other tools written by lakshmipathig packaged…
extcarve
extundelete

Tony

[Sorry for replying after a year :stuck_out_tongue: , I’m not sure how I missed your post. ]
Repo always found at its home page provided above ( not sure why you had the problem with it last year) or at github https://github.com/Lakshmipathi/giis-ext4
One clarification extundelete , is written by fellow community member not by me.Thanks.