I recently wiped an old ubuntu server of mine and installed debian, but i forgot to backup a very important file. I know there is a chance that the computer has already wrote over the file, but what can I do to look for this file?
Asked
Active
Viewed 616 times
-1
-
I'm afraid the file's likely lost at this point. – slm Sep 01 '14 at 07:04
1 Answers
0
The first thing is to not use the system at all. Everything you do increases the chances that you'll overwrite a part of the file. Depending on how important it is, I would pull the plug and image the hard drive first (e.g., with dd). If nothing else, use a live CD to look for the file. If it's very important, you could send it in to a recovery service.
The technique varies depending on how you wiped the old system, the file system, and perhaps disk media. If you just deleted everything and reinstalled, you could try something like extundelete. If you deleted the partition, you'll need to scan the disk/image file for files and pick through the matches. If it's a text file, you could even just grep through the image file.
melds
- 366
-
i used the debian installer to wipe the old partitions. I was taking a look at testdisk, but idk if that's safe. Could I possibly use a arch linux live usb and use testdisk to scan the disk for all possible files? – Painguy Sep 01 '14 at 06:59
-
@Painguy yes, you can use a live USB, mount the drive 'ro'. Most important is to stop using the drive immediately for anything, as melds indicated, so I hope you did not comment from your debian install. – Anthon Sep 01 '14 at 07:03
-
thx guys unfortunately the file is loooong gone. I only just reformatted everything, but I guess its too late. – Painguy Sep 02 '14 at 01:29