Dir gone - how to get it back?

[tv.debian at googlemail.com]

On 15/05/2013 18:13, rikona wrote:
> Wednesday, May 15, 2013, 3:56:23 AM, tv wrote:
> 
>> On 15/05/2013 11:38, Ric Moore wrote:
>>> On 05/15/2013 01:14 AM, rikona wrote:
>>>> I'm setting up a new 12.04 box. Just installed a few printers, which
>>>> seemed to go OK - BUT, after that, one of my home dirs is GONE! Was a
>>>> BIG one with about 1/3 of the stuff in home, and very important. Any
>>>> idea of why just that dir [apparently] disappeared? Better still, any
>>>> way to recover it? I can't see it via another admin account, or with
>>>> the CLI. New box, a few days of intensive work, and didn't do a backup
>>>> yet. :-(
>>>>
>>>> What's the best thing to do [not involving a large soothing glass of
>>>> Scotch :-) ]?
>>>
>>> Did you by any chance have it on it's own partition? (could but hope) so
>>> you need to only remount it? Ric
>>>
>>>
>>>
> 
>> If you really can't find it :
> 
>> _has it been renamed to something funny, try looking for it with
>> "ls -la"  in a console.
> 
> I tried that - but I was only looking for the 'real' name. Didn't
> check for something funny. A good idea...

I mentioned this because I had users inadvertently (bad command in
console, kid hitting keyboard while renaming...) renaming folders to a
"dot", or just a space.

> 
>> _Look for it with a disk usage tool (baobab, filelight) or from a
>> console with something like "du -a ~ 2> /dev/null | sort -rg | less"
> 
> I'll try those.
> 
>> _assume it's been deleted, try forensic tools like "extundelete",
>> "magicrescue" or "photorec" (from the "testdisc" package, good for many
>> file types, not only images). Look into the "/lost+found" folder.
> 
> I had someone help me with those recently [unfortunately]. Recovery
> was only partial - many came back with 0 size or corrupted. With
> 400,000 files, though, the biggest problem was trying to find the 300
> or so 'missing' files not in the last backup. Essentially impossible
> to do manually.
Recovery is always a tedious process.

> 
> What I needed was a tool to compare the two sets and ID the 'missing'
> ones in the recovery set, and ignore the ones that were the same. If
> you have a suggestion for how to do that, please let me know - I may
> need to do that again.
I'd start by computing control sums of the files (md5sum or sha1sum),
output it to files and diff those. Should highlight the missing ones.

> 
>> If possible you should try to work from an image of the disk, or from
>> another system (live-cd possibly), because if the folder has been
>> deleted your system is probably overwriting it right now by reusing the
>> freed space...
> 
> I did a bit of snooping, and when it seemed like there really was a
> problem, I shut down the box, and it is still off. And, yes, I will
> try to work with an image.
> 
> If I use a live-cd instead, and mount the disk so I can look at it,
> does that also allow the possibility of overwrites? An image takes a
> long time to make, and the live-cd might be quicker.

It's safe to work from a live-cd in your case as the disk isn't damaged
or dying, just mount it ro (read-only). If the disk was failing it would
definitely not be a good idea to hammer it with search and forensic tools.


>> Good luck.
> 
> Thanks - and many thanks for the detailed suggestions for how to
> proceed. The above would be a good check list to keep handy when
> disaster strikes...
>