undelete files from local fileserver

Question

I have a NAS (mybook world white light) in my living room where all my music and stuff is stored. I've mounted the music folder of the nas in the local music folder of my home directory on my desktop computer.

My fstab entry looks like this:

//192.168.2.222/Public/Shared\040Music/ /home/simon/Musik/ cifs credentials=/home/simon/.smbcredentials,defaults 0 0

A few minutes ago, I moved my home directory on my local desktop computer with the help of this (german) tutorial.

At first everything looks great, but then I realised that my music folder was empty. I think I deleted everything in this step during the tutorial:

umount /home
rm -rf /home/* 

Because the music folder was still mounted to /home/simon/Musik :/

Is there a possibility to recover something of the data? As I realized what happened, I shut down the NAS.

Answer 1

If you have not overwritten new data onto the drive, then depending on the filesystem of the NAS drive, you might be able to recover most, if not all, of it.

There are a number of tools for this task, some of them, like extundelete are specific to a filesystem or systems.

The Arch Wiki has a good page on file recovery.

Answer 2

For most recovery techniques, you'll need raw access to the NAS storage, i.e. mount the disk directly on your computer rather than access the NAS box over Samba. Or if the NAS box is itself running Linux or otherwise gives you a unix command line access, you can do recovery work by running commands directly on the NAS.

First, whatever you do, stop writing to the drive immediately. Access it in a read-only mode.

You can try to recover the filesystem structure; jasonwryan's answer has good pointers.

If that doesn't work, you can recover individual music files. Fortunately these files tend to have a recognizable signature and are (relatively!) easy to detect on a filesystem image, and if the NAS was new they'll not be fragmented much. Tools to recover data on a destructured storage medium are called carving tools; you might try Foremost, MagicRescue, PhotoRec (from the makers of TestDisk), … Most of these tools are available on typical unix distributions. But if you prefer, you can run a special-purpose distribution or other live CD including recovery tools such as SysRescueCD, Knoppix, CAINE…