accidently deleted files from directory

accidently deleted files from directory

[gert wohlgemuth]

Hi and thx for your help,

I'm running a gentoo box and using xfs as file system.

On the weekend it happens that I accidentally deleted 1 TB of data (rm -rdf
/mnt/lcq). We have no backup of the data (internal reasons of the
university...) and it would be nice to get the data somehow back.

After the delete the first step was to unmount the partion and this are the
info's from the xfs_check program.

meta-data=/mnt/lcq               isize=256    agcount=32, agsize=9154978
blks
         =                       sectsz=512
data     =                       bsize=4096   blocks=292959296, imaxpct=25
         =                       sunit=0      swidth=0 blks, unwritten=1
naming   =version 2              bsize=4096
log      =internal               bsize=4096   blocks=32768, version=1
         =                       sectsz=512   sunit=0 blks
realtime =none                   extsz=65536  blocks=0, rtextents=0

after I did a cat /dev/sda1 | less I could see that some data are still
exist and are not overwritten. So I think "all" what I have todo is some how
get the journal back.

Is there anyway or is all hope lost?

Thx gert

p.s. pleace CC me (wohlgemuth@ucdavis.edu) because I'm not a member of this
mailing list.

Re: accidently deleted files from directory

[Chris Wedgwood]

On Mon, Aug 28, 2006 at 05:05:30PM -0700, gert wohlgemuth wrote:

> On the weekend it happens that I accidentally deleted 1 TB of data
> (rm -rdf /mnt/lcq). We have no backup of the data (internal reasons
> of the university...) and it would be nice to get the data somehow
> back.

ouch

> after I did a cat /dev/sda1 | less I could see that some data are still
> exist and are not overwritten. So I think "all" what I have todo is some how
> get the journal back.

that won't suffice, the metadata showing where all the files are is
likely gone

> Is there anyway or is all hope lost?

if you know what the data looks like heuristically scan for it and try
to glue the fragments back together...

RE: accidently deleted files from directory

[gert wohlgemuth]

Thx,

I thought so that the data are gone and it's to much to glue it, cause all
binary data.

So time to step back to ext2, here at least I can restore the data in the
worst case.

...not that it ever happens again...

g.


-----Original Message-----
From: Chris Wedgwood [mailto:cw@f00f.org] 
Sent: Monday, August 28, 2006 9:17 PM
To: gert wohlgemuth
Cc: xfs@oss.sgi.com
Subject: Re: accidently deleted files from directory

On Mon, Aug 28, 2006 at 05:05:30PM -0700, gert wohlgemuth wrote:

> On the weekend it happens that I accidentally deleted 1 TB of data
> (rm -rdf /mnt/lcq). We have no backup of the data (internal reasons
> of the university...) and it would be nice to get the data somehow
> back.

ouch

> after I did a cat /dev/sda1 | less I could see that some data are still
> exist and are not overwritten. So I think "all" what I have todo is some
how
> get the journal back.

that won't suffice, the metadata showing where all the files are is
likely gone

> Is there anyway or is all hope lost?

if you know what the data looks like heuristically scan for it and try
to glue the fragments back together...

Re: accidently deleted files from directory

[Timothy Shimmin]

gert wohlgemuth wrote:
> Hi and thx for your help,
> 
> I'm running a gentoo box and using xfs as file system.
> 
> On the weekend it happens that I accidentally deleted 1 TB of data (rm -rdf
> /mnt/lcq). We have no backup of the data (internal reasons of the
> university...) and it would be nice to get the data somehow back.
> 
> After the delete the first step was to unmount the partion and this are the
> info's from the xfs_check program.
> 
> meta-data=/mnt/lcq               isize=256    agcount=32, agsize=9154978
> blks
>          =                       sectsz=512
> data     =                       bsize=4096   blocks=292959296, imaxpct=25
>          =                       sunit=0      swidth=0 blks, unwritten=1
> naming   =version 2              bsize=4096
> log      =internal               bsize=4096   blocks=32768, version=1
>          =                       sectsz=512   sunit=0 blks
> realtime =none                   extsz=65536  blocks=0, rtextents=0
> 
> after I did a cat /dev/sda1 | less I could see that some data are still
> exist and are not overwritten. So I think "all" what I have todo is some how
> get the journal back.
> 
What journal would that be?
If you are referring to the xfs journal or log, then that won't help you.
It is just logging metadata.
It is also only designed for replay for metadata which didn't make it to disk.

> Is there anyway or is all hope lost?
We don't support undelete as the FAQ says :)
I suggest you go thru the mailing list archive and see if anyone has suggestions
for scanning the device. Good luck :)

--Tim

Re: accidently deleted files from directory

[Klaus Strebel]

gert wohlgemuth schrieb:
> Thx,
> 
> I thought so that the data are gone and it's to much to glue it, cause all
> binary data.
> 
> So time to step back to ext2, here at least I can restore the data in the
> worst case.
Just out of curiosity, could you write an info to the list, how long
your 'some-terrabyte-ext2'-filesystem needs to mount and - every 20th-or
-so mount, how long a fsck is running on when if it's well filled ;-).
I once tried to restore deleted files on a webserver using ext2, i can
tell you, thats no fun. Many programs make copies of the files they are
working on, write there changes, delete the old file and rename the new.
So expect to get lots and lots of versions of files where you have to
decide which is the latest you want to use, and sometimes, its not the
latest by accesstime ...

> 
> ...not that it ever happens again...
>> after I did a cat /dev/sda1 | less I could see that some data are still
>> exist and are not overwritten. So I think "all" what I have todo is some
> how
>> get the journal back.
> 
> that won't suffice, the metadata showing where all the files are is
> likely gone
> 
Well, getting a consistent state ( in this case all metadata removed )
is why we use filesystems like XFS.

-- 
Mit freundlichen Grüssen / best regards

Klaus Strebel, Dipl.-Inform. (FH), mailto:klaus.strebel@gmx.net

/"\
\ /     ASCII RIBBON CAMPAIGN
 X        AGAINST HTML MAIL
/ \

Re: accidently deleted files from directory

[Olaf Frączyk]

On Tue, 2006-08-29 at 15:29 +1000, Timothy Shimmin wrote:
> gert wohlgemuth wrote:
> > Hi and thx for your help,
> > 
> > I'm running a gentoo box and using xfs as file system.
> > 
> > On the weekend it happens that I accidentally deleted 1 TB of data (rm -rdf
> > /mnt/lcq). We have no backup of the data (internal reasons of the
> > university...) and it would be nice to get the data somehow back.
> > 
> > After the delete the first step was to unmount the partion and this are the
> > info's from the xfs_check program.
> > 
> > meta-data=/mnt/lcq               isize=256    agcount=32, agsize=9154978
> > blks
> >          =                       sectsz=512
> > data     =                       bsize=4096   blocks=292959296, imaxpct=25
> >          =                       sunit=0      swidth=0 blks, unwritten=1
> > naming   =version 2              bsize=4096
> > log      =internal               bsize=4096   blocks=32768, version=1
> >          =                       sectsz=512   sunit=0 blks
> > realtime =none                   extsz=65536  blocks=0, rtextents=0
> > 
> > after I did a cat /dev/sda1 | less I could see that some data are still
> > exist and are not overwritten. So I think "all" what I have todo is some how
> > get the journal back.
> > 
> What journal would that be?
> If you are referring to the xfs journal or log, then that won't help you.
> It is just logging metadata.
> It is also only designed for replay for metadata which didn't make it to disk.
> 
> > Is there anyway or is all hope lost?
> We don't support undelete as the FAQ says :)
> I suggest you go thru the mailing list archive and see if anyone has suggestions
> for scanning the device. Good luck :)
It won't be easy. All depends on what data did you have on that disk.
I remember that some time ago a friend of mine has deleted a lot of
jpegs from one partition. I was able to recover most of the data just
reading the disk, looking for something that looked like the beginning
of jpeg file and then copying till the end marker or < 6 MB.
If you know what data were on the device and what to do find them out,
the filesystem is not too fragmented and single files are not big then
you should be able to relativelly easy recover the data. Just find
somebody at your university that knows a little C programming and you
should be fine. In other case - if the data are woth it - I would look
for a company specialized in data recovery, but that will be pricey :(

Regards,

Olaf
-- 
Olaf Frączyk <olaf@cbk.poznan.pl>

RE: accidently deleted files from directory

[gert wohlgemuth]

Yeah like always (it would be boring afterwards)

1. our file size is between 100k - 20 GB
2. we have tons of these files...
3. we have all kind of files from xls,xml,bz2 to special files from
scientific machines.

In short we gave up and considering it a loss and a lesson for the future. 

At least I get now the money for a backup server with some space...

Thx for all your help!

gert

-----Original Message-----
From: Olaf Frączyk [mailto:olaf@cbk.poznan.pl] 
Sent: Tuesday, August 29, 2006 1:04 AM
To: Timothy Shimmin
Cc: gert wohlgemuth; xfs@oss.sgi.com
Subject: Re: accidently deleted files from directory

On Tue, 2006-08-29 at 15:29 +1000, Timothy Shimmin wrote:
> gert wohlgemuth wrote:
> > Hi and thx for your help,
> > 
> > I'm running a gentoo box and using xfs as file system.
> > 
> > On the weekend it happens that I accidentally deleted 1 TB of data (rm
-rdf
> > /mnt/lcq). We have no backup of the data (internal reasons of the
> > university...) and it would be nice to get the data somehow back.
> > 
> > After the delete the first step was to unmount the partion and this are
the
> > info's from the xfs_check program.
> > 
> > meta-data=/mnt/lcq               isize=256    agcount=32, agsize=9154978
> > blks
> >          =                       sectsz=512
> > data     =                       bsize=4096   blocks=292959296,
imaxpct=25
> >          =                       sunit=0      swidth=0 blks, unwritten=1
> > naming   =version 2              bsize=4096
> > log      =internal               bsize=4096   blocks=32768, version=1
> >          =                       sectsz=512   sunit=0 blks
> > realtime =none                   extsz=65536  blocks=0, rtextents=0
> > 
> > after I did a cat /dev/sda1 | less I could see that some data are still
> > exist and are not overwritten. So I think "all" what I have todo is some
how
> > get the journal back.
> > 
> What journal would that be?
> If you are referring to the xfs journal or log, then that won't help you.
> It is just logging metadata.
> It is also only designed for replay for metadata which didn't make it to
disk.
> 
> > Is there anyway or is all hope lost?
> We don't support undelete as the FAQ says :)
> I suggest you go thru the mailing list archive and see if anyone has
suggestions
> for scanning the device. Good luck :)
It won't be easy. All depends on what data did you have on that disk.
I remember that some time ago a friend of mine has deleted a lot of
jpegs from one partition. I was able to recover most of the data just
reading the disk, looking for something that looked like the beginning
of jpeg file and then copying till the end marker or < 6 MB.
If you know what data were on the device and what to do find them out,
the filesystem is not too fragmented and single files are not big then
you should be able to relativelly easy recover the data. Just find
somebody at your university that knows a little C programming and you
should be fine. In other case - if the data are woth it - I would look
for a company specialized in data recovery, but that will be pricey :(

Regards,

Olaf
-- 
Olaf Frączyk <olaf@cbk.poznan.pl>