recover deleted files

[Polytropon]

On Tue, 17 May 2016 09:51:18 +0500, Shahin Hasanov wrote:
> Hi everybody!
> rsync accidentally delete my files and directories. I knew the name all
> deleted files, 

That doesn't help much, sorry.



> Please tell me how I can recover my deleted files.

You cannot. Restore from backup.

In fact, you can, but you need to act quickly. Do not use the
partition where your data has been located. Allow no further
writes. Afterwards, make yourself familiar with recovery tools.
Refer to the list archive and check out my older posts regarding
this topic (keywords: UFS recovery, fat fingers, undelete).

I lost lots of files, too - but I was able to recover them. Keep
in mind that "there is an app for this" and "one app fits all needs"
does not apply.

I will provide my "famous list" of recovery tools as a starting
point:

OS tools:

	fetch -rR <device>
	recoverdisk

Ports collection:

	ddrescue
	dd_rescue	<- use this to create images to work with
	magicrescue
	testdisk	<- restores content
	recoverjpeg
	foremost
	photorec
	ffs2recov
	scan_ffs
	tsk		<- The Sleuth Kit
		fls
		dls
		ils
		autopsy

Proprietary (free test version for diagnostics):

	SysDev Laboratories LLC "UFS Explorer"

You usually will need to understand what you're doing. Read
"A Fast File System for UNIX" by M. K. McKusick. as a good
introduction. It helped me a lot.

http://pages.cs.wisc.edu/~dusseau/Classes/CS537-S01/ffs.pdf

You will then understand why "easy undeleting" of files and
directories is not possible by design. Blocks of deleted files
are marked "free", and they are not connected to any inodes
anymore. But as long as the blocks don't get overwritten, their
content will be there.

Probably TSK (The Sleuth Kit) is the way to go. In worst case,
it can recover anything. But try the "easier tools" like
photorec and magicrescue.

What you need to do depends on the kind of files you want to
recover.

If you're searching for specific files, using "grep" on the
disk device is possible as well; I once wrote an inefficient
and stupid script for that task. Just make sure you do not
cause any writes within the boundaries of the partition you
want to rescue from. Write to another disk partition, disk,
or USB media, or network. You can also make a copy of the
whole partition and work with that (as a file).




> mount
> /dev/da1p1  (ufs,  local, journaled soft-updates)

Do not mount r/w where you want to recover from - the message
is missing the "read-only" element. Any writes may destroy your
data. Be very careful.



Good luck.



-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...