[SATLUG] Re: File Recovery Help

[Justin Ryan]

Here's a solution one of my co-workers used to restore a customer's
data:

It may be necessary to boot off of a rescue cd, mount the root fs, and
chroot into it first - I'm not 100% sure (but it would be a good idea).

debugfs /dev/hda5 -R lsdel | grep Sep\ 27 | awk {'print $1'} > list
#this gives a list of deleted inodes(files) from today (Sep 27)

for i in `cat list`; do debugfs /dev/hda5 -R dump <$i> /restore/$i ;
done
#this restored the contents of each inode as it's inode number in the
/restore directory

You'll have to examine the files to determine which is which.. good
luck, and be careful with rm in the future (tar files up, keep around
for a few days?)

cheers!

On Fri, 2002-09-27 at 18:57, Geoffrey Derber wrote:
> Supposedly there is a way, but it can be difficult to do.  The very 
> first thing you should do is unmount that partition.  Beyond that, I 
> don't remember off hand, and I couldn't get it to work the last time I 
> tried.
> 
> Geoff
> 
> infinitemike at softhome.net wrote:
> > You are out of luck.  Sorry.
> > Mike
> > 
> > Jaret Pfluger writes:
> > 
> >> I just did a  "rm /accounts -fr" and deleted files I'd like to have 
> >> back. :(
> >> Is there any way to recover?  Or am I out of luck?
> >> Thanks for any help.
> >> Jaret