Data Rescue


Table of Contents

undeleting files 
data rescue from a screwed up hd partition 
Recover Data From a dead hard drive using ddrescue 
Recover Data From a dead hard drive using ddrescue 
Recover Data From a dead hard drive using ddrescue 
Recover Data From a dead hard drive using ddrescue 
Recover Data From a dead hard drive using ddrescue 
Recovering from file system corruption using TestDisk 
Recovering from file system corruption using TestDisk 
Recovering from file system corruption using TestDisk 
Using PhotoRec 
My Great Linux System Repair Adventure 
Copy: abort, retry, *ignore* 
Copy: abort, retry, *ignore* 
Copy: abort, retry, *ignore* 
ugly file permissions ?? 
ugly file permissions ?? 
ugly file permissions ?? 
Mandrake formated my fat32 partition. HELP 
Mandrake formated my fat32 partition. HELP 
Lost partition table, system still running 
Appendix1: cat /proc/partitions 
Appendix2: gpart output 

undeleting files 

http://www.cs.johncabot.edu/~min/linux/

  • stop in your tracks, do as little as possible with your files
  • let's assume you deleted some files from /home/myaccount/source
  • find out which partition the deleted file is on. For example, run df, and see that /home is a directory under /, which lives on /dev/hda5 (all examples, your case may be different)
  • su to root
  • for safety, umount /dev/hda5 (this may not be possible though)
  • change to a directory on a different partition (/boot for example), and create a temp directory there
  • run debugfs /dev/hda5
  • at the prompt, run lsdel. It will list inode, owner, mode, size, blocks & time of all deleted files on that partition. This list could be long. Near the bottom are your recently deleted files. You'll recognize them by the id (run id to find out your account's id number), filesize, deletion time. Note the inodes of the files you want to recover.
  • run dump < inode > /boot/temp/filename for each file you want to recover. Note: you need the angled brackets around the inode number!

A program which has a more sophisticated interface for doing this is e2undel. (I'll write some info on this program here later).