2

I accidentally deleted ALL files for my web server yesterday, and for some silly reason I have not made a backup in the last three months... Shame on me, I know.

The files were deleted with a bad rm command, and the system was immediately shut down after I noticed. The files are mostly HTML, CSS and JavaScript, with occasional images and other files.

I downloaded SystemRecoveryCD, put it on a USB stick, booted it and ran PhotoRec on the disk. It found a few hundred thousand deleted files. They are all now safe on another disk on another computer. The correct files seem to have been found too.

Unfortunately, they are all put in some numbered folders, and all have a strange name beginning with "f" followed by what I suppose is the inode number of the file. An example is recup_dir.15/f990850128.h. All timestamps and other metadata are also gone, along with the directory structure.

I grepped for the contents of one of the most important files, and it came up with no less than 397 versions of it. I assume each corresponds to a save of the file.

How can I find the newest version of the files? Are the ones with higher number in the filename probably newer? It looks like that from some quick visual inspection. Should I possibly try to recover them with something other than PhotoRec? The computer has not been booted into anything but SystemRecoveryCD since the accident happened, so the disk should be unchanged. It is an ext4 filesystem. It is not corrupt nor encrypted.

Jakuje
  • 21,357
Suppen
  • 123

2 Answers2

0

Can you please try ForeMost. I had a similar situation before and foremost helped me a lot. http://foremost.sourceforge.net/

SupportSages
  • 11
  • 1
  • I was able to recover the files with extundelete, but will keep this program in the back of my head. Thanks! – Suppen Jan 15 '15 at 08:16
0

If you are using ext3 or ext4 based filesystem you can use extundelete. And then do:

extundelete /dev/sda4 --restore-all

(assuming the filesystem was on sda4), this should get your files back in the correct directory hierarchy.

If you have to install, or download and compile that, don't do that on the disc that has to be undeleted (you already have hooked it up to a different machine, but maybe future vistors to this question have skipped that parts which is important) It is also a good idea to make a backup of the partition (using dd) in case the undeletion doesn't work as expected, so you can restore things (use the currently unused space on the backup, that you should have, for that )

Anthon
  • 79,293
  • Thank you very much indeed! I was able to recover the entire directory :D. Since I knew the time I deleted the files, I used the option --after , which recovers only files deleted after that time. – Suppen Jan 15 '15 at 08:57