From nobody Sat Apr 16 12:48:47 2022 X-Original-To: freebsd-current@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 8A3BF7CF2B3 for ; Sat, 16 Apr 2022 12:49:18 +0000 (UTC) (envelope-from jhs@berklix.com) Received: from slim.berklix.org (slim.berklix.org [94.185.90.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "slim.berklix.org", Issuer "slim.berklix.org" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4KgY18618cz4l8R for ; Sat, 16 Apr 2022 12:49:16 +0000 (UTC) (envelope-from jhs@berklix.com) Received: from mart.js.berklix.net (p4fe6d03e.dip0.t-ipconnect.de [79.230.208.62]) (authenticated bits=128) by slim.berklix.org (8.15.2/8.15.2) with ESMTPSA id 23GCn3kN063545 (version=TLSv1 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sat, 16 Apr 2022 14:49:07 +0200 (CEST) (envelope-from jhs@berklix.com) Received: from fire.js.berklix.net (fire.js.berklix.net [192.168.91.41]) by mart.js.berklix.net (8.14.3/8.14.3) with ESMTP id 23GCn25A031401; Sat, 16 Apr 2022 14:49:03 +0200 (CEST) (envelope-from jhs@berklix.com) Received: from fire.js.berklix.net (localhost [127.0.0.1]) by fire.js.berklix.net (8.14.7/8.14.7) with ESMTP id 23GCmlIP044778; Sat, 16 Apr 2022 14:48:57 +0200 (CEST) (envelope-from jhs@berklix.com) Message-Id: <202204161248.23GCmlIP044778@fire.js.berklix.net> To: Sami Halabi cc: FreeBSD Current Subject: Re: recover deleted file From: "Julian H. Stacey" Organization: http://berklix.com/jhs/ User-agent: EXMH on FreeBSD http://berklix.com/free/ X-From: http://www.berklix.org/~jhs/ In-reply-to: Your message "Sat, 16 Apr 2022 13:59:09 +0200." <70EA83C9-61AE-4256-9FF4-458197BA261D@freebsd.org> Date: Sat, 16 Apr 2022 14:48:47 +0200 X-Rspamd-Queue-Id: 4KgY18618cz4l8R X-Spamd-Bar: / Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=none (mx1.freebsd.org: domain of jhs@berklix.com has no SPF policy when checking 94.185.90.68) smtp.mailfrom=jhs@berklix.com X-Spamd-Result: default: False [0.46 / 15.00]; RCVD_VIA_SMTP_AUTH(0.00)[]; ARC_NA(0.00)[]; FREEFALL_USER(0.00)[jhs]; FROM_HAS_DN(0.00)[]; R_SPF_NA(0.00)[no SPF record]; URI_HIDDEN_PATH(1.00)[http://berklix.com/~jhs/bin/.sh/lslf]; MIME_GOOD(-0.10)[text/plain]; DMARC_NA(0.00)[berklix.com]; AUTH_NA(1.00)[]; NEURAL_SPAM_MEDIUM(0.30)[0.301]; HAS_ORG_HEADER(0.00)[]; RCVD_COUNT_THREE(0.00)[4]; TO_MATCH_ENVRCPT_SOME(0.00)[]; TO_DN_ALL(0.00)[]; NEURAL_HAM_LONG(-0.75)[-0.747]; RCPT_COUNT_TWO(0.00)[2]; NEURAL_HAM_SHORT(-0.99)[-0.992]; MLMMJ_DEST(0.00)[freebsd-current]; FREEMAIL_TO(0.00)[gmail.com]; FROM_EQ_ENVFROM(0.00)[]; R_DKIM_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:33824, ipnet:94.185.88.0/22, country:DE]; RCVD_TLS_LAST(0.00)[]; RECEIVED_SPAMHAUS_PBL(0.00)[79.230.208.62:received] X-ThisMailContainsUnwantedMimeParts: N List-Id: Discussions about the use of FreeBSD-current List-Archive: https://lists.freebsd.org/archives/freebsd-current List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-current@freebsd.org > Depends on the kind of file. > > You can always: > 1. reboot the system into single user mode, mount the fs readonly (important= > to not overwrite data you want to recover) > 2. dd the partition and into a file > 3. find the content of the deleted file in the dump > > I was able to recover a complete codebase i deleted accidentally that way a l= > ong time ago. > > Good luck > Michael If it was my personal laptop with an external disk/ stick, I would _immediately_ pull the USB cable out. If a personal PC I would _immediately_ turn power off. I would Not do an unmount or sync or processes kill or shutdown. Then I would reboot single user, fsck & mount only the partitions the data was Not on., dd the partition to recover, then fsck the partition & mount it, & go multi user, then I'd make a 2nd copy of the partition with data to recover & start exploration with eg fsdb man fsdb: SEE ALSO editline(3), fs(5), clri(8), fsck(8), /usr/ports/ { graphics/recoverjpeg, sysutils/ { autopsy, dd_rescue, ddrescue, fatback, ffs2recov, foremost, gpart, magicrescue, recoverdm, scan_ffs, sleuthkit, testdisk } }. If you work had been on text using vi, then vi -r might show a recovery, hint copy the original before running vi -r file , as sometimes pre recovery is better than after. various lost+found may have stuff in http://berklix.com/~jhs/bin/.sh/lslf PS personaly I hand run numerous rdist6 or rsync through the day, when editing important stuff. They run fast, as incremental update, so avoid losing all but the last short period in a day. Cheers, -- Julian Stacey http://berklix.com/jhs/ http://StolenVotes.UK Kill / remove Putin to stop him killing & provoking world war.