How to recover deleted files

[Andrew Farris]

On Mon, 2010-04-19 at 16:33 +0530, Vijay Shanker Dubey wrote: 
[snip]
>         Nevertheless, I really wonder who told you deleting something
>         means
>         unmounting. You don't delete a drive on Windows when you want
>         to
>         remove it. 
> Sorry to say. But i am not agree with you. Mounting means pointing
> some hard disk space in the file system to my /media directory. If I
> am deleting a pointer why should my data at the pointer will be
> deleted. All I want to know is this much. 

You're right...HOWEVER you DIDN'T just delete the pointer to your data,
you did:
rm -r <path-to-your-stuff>
which is deleting the pointer AND recursively deleting everything that
pointer points to.  Direct from the rm man page:
               -r, -R, --recursive
                      remove directories and their contents recursively

This is a disaster waiting to happen. I understand what you were trying
to do, which was:
rm <path-to-your-stuff>

but even so...why would you do this while the filesystem is mounted? 

> There is another thing like symliks(shortcuts in windows). I thought
> of mounting as this only. It is ridiculous if Deleting a shortcut will
> cause the data to be deleted. :( 

As stated above... you didn't just delete the shortcut. you basically
told the tool to delete the shortcut, and everything the shortcut
pointed to... which it hapily obliged, completely oblivious to what you
actually wanted to do. You SHOULD have done a:
umount <path-to-your-stuff>
which would have unmounted your data partition (if that's what you
wanted to do...) and if you still then wanted to remove the /media
folder that formerly housed the partition, THEN it would have been safe
to remove the folder, using either your method(unsafe) or mine(safer). 

Also, FYI it actually didn't behave any different than if you had done:
rd /s <path-to-your-stuff>
on windows... that doesn't prompt you if you actually want to delete
everything either, it just does it. the prompting can be activated of
course (with the /p switch, or with rm, the -i or -I switches)... so in
reality, this behavior is perfectly normal for both OSes. 

What I find more interesting is how you weren't able to recover any data
off of the partition on linux, and only a minuscule amount on windows.
I've personally had great success recovering deleted files for people
(mostly windows users), and I usually use linux-based tools to do so. I
personally usually use dd, magicrescue, and foremost, though I've also
used others. For windows-based tools, I usually try to use the freeware
app Recuva: www.piriform.com/recuva.  
Most recently, I used it to recover about 300GB of data from a partition
that had been thrice-formatted (somebody who didn't know what they were
doing trying to reinstall windows). Maybe it's not too late to work for
you as well (don't save onto that partition, and make sure to set Recuva
to 'Deep Scan' if you use it). If you need any help using the program,
or sorting the data, let me know. I made some scripts for the
previously-mentioned task that sorted files by their meta-info (since
often you can recover billions of files whos names are missing/mangled)
that I'd be happy to send to you and explain, if need be.

Hope that helps

-- 
Andrew
_____________________________
Registered Linux User: 473690
Registered Ubuntu User: 22747