Slashdot Mirror
Recovering Deleted Files on ReiserFS3?
DarkSarin asks: "I have a rather serious problem: I managed to accidentally delete some files (rather important ones at that!) while trying to back them up to cd (I was using a GUI burning software that will remain nameless for now). How do you recover accidentally deleted files in Reiserfs? This thread (started by me) indicates that you can't recover them. Note that I had found a way to rebuild the tree, but that didn't work. It seems odd to me that you wouldn't be able to recover accidental deletions, but that really does seem to be the case. Help? Please?"
A filesystem has never (AFAIK) implemented a trash / recycle bin folder -- not on Windows or OS X, and not on any UNIX that I know of.
The reason for this is that a recycle bin is to save you from accidental deletions. If you delete a file from the nice, big, friendly GUI, it usually asks you at least once whether you want to delete it, then instead moves it to the trash. When it's time to empty the trash, it asks you again to make sure you're not screwing yourself over.
However, many programs create temporary files and then promptly delete them -- so many times that it would be ridiculously inefficient (both in space and fragmentation levels) to put them into the trash. Furthermore, can you imagine looking for your files in the middle of all sorts of files with names like 11025u012348512i51253.tmp?
As someone said on the other forum, there's the hard way -- grep for it on the raw partition. This may not even work with ReiserFS, I'm not sure. The usual way to protect yourself from this is to back up in the first place (yeah, I know) and to only run programs you trust as a user that can delete files that you need.
I would suggest that you try the grep method, and if that doesn't work, learn from it. The safest way to do this is (ironically) the command line. If you type "cp", you know for sure it will copy the file. If you type "mkisofs" or something similar, it is very unlikely that it will delete the files. And these tools (along with mv, which does delete the old copy after the new one is successful) have been around for so long and are so simple that the only way you could screw this up is through a very stupid mistake (like rm instead of cp) or using an experimental filesystem, which despite the opinion at Gentoo, ReiserFS is not.
Don't thank God, thank a doctor!
Take the filesystem offline. NOW!
Then use dd to copy the partition to another partion/disk. Then mess with the copy.
A lot of silesystems do a good job at keeping files and their blocks in order. I've had luck with *BSD file-system by grepping for somthing at the begining of the file and grabbing a big chunk of data afterwords. This works great for MS Office Documents, JPEG or anthing that begins with a known preamble.
This may not work for your filesystem.
Moneyed corporations, non-working 'poor' and criminal prisoners are turning productive citizens into tax-slaves.
First off, I have several questions. Do you have an original copy of the partition before you started running recovery tools (after you deleted the file, but before you created new ones)? If not, make an image immediately. You want the most original image you can find. Now, the second question, is how much data am I a looking for, and how large is the partition? (How large is the needle, and how large is the haystack?). What type of data am I looking for? Is it a word document? A text file? A gif? A jpg? Some html? A PDF? The smaller the file, the more likely that if it got overwritten, it all got overwritten. However, the more likely you are to recover all of it. If it was a very large file, it's possible that you can recover pieces and parts, but not all of it. Now, it's my understanding that you can recover anything written to a harddrive, even if you have overwritten it several times. However, it's very, very expensive to do so. So now the question is how much money is it worth to you? The guys as ReiserFS probably have the best shot at helping you. They probably don't want to however. The more you know about the order of the files in the directory, the more you know about how the files were constructed, and the order files got put on disk the better. They you can make better educated guesses about the sequence in which the pages got allocated to know where to go look for the file. Do you have anything on the drive you are worried about posting? Can you post an image of the drive? I'm not an expert in this area, but I've seen people recover mail spools at an ISP using dd. People leave ISP's over losing all their mail, so they worked really hard at it (however, that was an ext2 filesystem). Kirby
If you had this problem then I or anyone will have this problem too, so please let us know what program you are talking about. Was a user error? Was it a bug? Is the bug being worked on?
Useless sig.
...every Windows user looks at that Recycle Bin shortcut on their desktop and smiles.
(No, that's not really a troll. Human error happens.)
I really don't understand how this was done. None the less you CAN recover from this. Here's a little tutorial I found. I Highly suggest doing the backup first!!! :
::-)
:3 18421306&w=2.
If you're really really desperate, you can do what I did a few weeks ago. In my \
case, fsck didn't recover the partition either, indeed it crashed. So here's what's \
I did from the beginning of what I think fixed it:
1) reiserfsck --rebuild-tree
2) mount
3) reiserfsck -S
4) debugreiserfs to get metadata for Vitaly
5) mount
6) mount again
I'm not sure why this happened, but after the second mount, the partition was not \
recognizeable as ReiserFS anymore. I suspect it had to do with a few really huge \
files that were originally on the partition that reisefsck -S tried to recover. In \
doing so it probably hosed lots of stuff. Now, it was as simple as
7) reiserfsck --rebuild-tree
And I had most of my data linked under lost+found! Took me a few hours to sort \
through it all but I got back most of what I cared about. Maybe if you use the new \
pre8 fsck you won't need to jump through these hoops. Since the potential for data \
destruction is high here, I wouldn't blame you for not trying. And yes, this all \
happened by trial and error
This might help too
http://marc.theaimsgroup.com/?l=reiserfs&m=104861
Good luck!
Pay Namesys $25. They wrote ReiserFS so they should know. You'll be getting really great support and helping those who wrote your file system. Look here:
http://www.namesys.com/support.html
I beleive i used the --rebuild-tree option. You should follow the steps in the manpage under Example.
so in short, man reiserfsck before asking slashdot
-- botsex is {grep;touch;strip;unzip;head;mount}
But it can be helpful in the future to dedicate, say 10% of your drive to an LVM snapshot space....
:)
I haven't done this yet (I'm lucky! I have a real tape drive to backup my stuff.....) but I plan to make my system take a snapshot every hour and every day (total of two) so that at most I lose an hour's worth of work.
Also, I've always wondered if it was possible to make an operating system that would take as long to destroy something as it did to create it. For example, your term paper took ten days to write, so the rm termpaper.tex command would take ten days to run
Fellowship 9/11
Nice job karma-whoring, but TCT does NOT work with journaled filesystems.
Depending on what you want to undelete, you can always do a grep -a -100 STRING
Since ext3 is just ext2 with added features, you can undelete the file the way you would do so on ext2. There's actually an undelete howto for ext2. The basic gist of it is that you immediately unmount and remount the partition read only. Then you grab a list of last delete blocks and use that to recontruct the file. I've done it once or twice but I've been fortunate enough to have a tape backup solution that has been able to alleviate the need for this for a while now.
"When you sit with a nice girl for two hours, it seems like two minutes. When you sit on a hot stove for two minutes, it
"I was using a GUI burning software that will remain nameless for now"
_Either_
- you fucked up, be a man and admit it's your fault;
- the software fucked up, in which case let others know what it was and how it fucked up so that they can avoid risking the same bug.
YAW.
Your head of state is a corrupt weasel, I hope you're happy.
How do you recover accidentally deleted files in Reiserfs?
It's really easy. You just restore from backup.
Just FYI. Netware's file system does have a trashcan built in and will keep the files that you've deleted. Even multiple versions of them until ther is no room on the storage device, then it will start to actually delete the oldest deleted files at that point. It's quite useful! you can disable the function globally or just on a directory/tree also. It has been doing this since version 2 for sure. Possible even before that.
Perhaps also you don't understand that I /like/ holding shift. Delete is a powerful word, you must use it with care.
-- 'The' Lord and Master Bitman On High, Master Of All