recover deleted files

[Shahin Hasanov]

Hi everybody!
rsync accidentally delete my files and directories. I knew the name all deleted files,
Please tell me how I can recover my deleted files.

mount
/dev/da1p1 (ufs, local, journaled soft-updates)
# uname -v
FreeBSD 10.1-RELEASE-p14 #0: Wed Jul 1 22:14:36 AZST 2015

Kind regards
Shahin

[Polytropon]

Post by Shahin Hasanov
Hi everybody!
rsync accidentally delete my files and directories. I knew the name all
deleted files,

That doesn't help much, sorry.

Post by Shahin Hasanov
Please tell me how I can recover my deleted files.

You cannot. Restore from backup.

In fact, you can, but you need to act quickly. Do not use the
partition where your data has been located. Allow no further
writes. Afterwards, make yourself familiar with recovery tools.
Refer to the list archive and check out my older posts regarding
this topic (keywords: UFS recovery, fat fingers, undelete).

I lost lots of files, too - but I was able to recover them. Keep
in mind that "there is an app for this" and "one app fits all needs"
does not apply.

I will provide my "famous list" of recovery tools as a starting
point:

OS tools:

fetch -rR <device>
recoverdisk

Ports collection:

ddrescue
dd_rescue <- use this to create images to work with
magicrescue
testdisk <- restores content
recoverjpeg
foremost
photorec
ffs2recov
scan_ffs
tsk <- The Sleuth Kit
fls
dls
ils
autopsy

Proprietary (free test version for diagnostics):

SysDev Laboratories LLC "UFS Explorer"

You usually will need to understand what you're doing. Read
"A Fast File System for UNIX" by M. K. McKusick. as a good
introduction. It helped me a lot.

http://pages.cs.wisc.edu/~dusseau/Classes/CS537-S01/ffs.pdf

You will then understand why "easy undeleting" of files and
directories is not possible by design. Blocks of deleted files
are marked "free", and they are not connected to any inodes
anymore. But as long as the blocks don't get overwritten, their
content will be there.

Probably TSK (The Sleuth Kit) is the way to go. In worst case,
it can recover anything. But try the "easier tools" like
photorec and magicrescue.

What you need to do depends on the kind of files you want to
recover.

If you're searching for specific files, using "grep" on the
disk device is possible as well; I once wrote an inefficient
and stupid script for that task. Just make sure you do not
cause any writes within the boundaries of the partition you
want to rescue from. Write to another disk partition, disk,
or USB media, or network. You can also make a copy of the
whole partition and work with that (as a file).

Post by Shahin Hasanov
mount
/dev/da1p1 (ufs, local, journaled soft-updates)

Do not mount r/w where you want to recover from - the message
is missing the "read-only" element. Any writes may destroy your
data. Be very careful.



Good luck.

[Polytropon]

(Re-attaching to mailing list, hope that's okay.)

Thank you for detail information. My files Vmware machines , type
of files are vmx,vmsd, vmdk . There a big files about 50 GB.

Okay, that might be a useful information. You probably have other
files of that type. Check out how they start and if they are
identical (for each type) in a sufficiently high number of bytes
("magic"). Then you can grep for the start of those files and
dd the required size from the source disk. The files are big,
so using an editor for this task is stupid. But dd will do. :-)

Another idea might be to check out fsdb. It's an OS provided
program which could "re-attach" the inodes - in case nothing
got overwritten yet. If we take this statement as a base, the
task is to assign the data to files again. This is not a trivial
task, but probably still possible.

I tried to used photorec and testdisk. I can not manged recovery it.

Those tools are probably the wrong ones for this task.

It gives me a lot of file.

It usually recovers anything it can.

But deleted three directories which of directories contain 7-9
files. I have Februrary backup. Anycase I'd like to repair it.
Please some advise.

Check out the TSK documentation. In the past, they included good
documentation with the installation. Sadly this has been moved to
an online wiki which makes accessing it harder, but I found the
article that formerly was "ref_fs.txt":

http://wiki.sleuthkit.org/index.php?title=FS_Analysis

This will provide you very helpful information on how to continue.
As I initially mentioned: You need to check _which_ tool will work
for your specific situation. There is no "one size fits all".