Dir gone - how to get it back?

[rikona]

Wednesday, May 15, 2013, 9:50:11 AM, tv wrote:

<snips>

>>> If you really can't find it :
>> 
>>> _has it been renamed to something funny, try looking for it with
>>> "ls -la"  in a console.
>> 
>> I tried that - but I was only looking for the 'real' name. Didn't
>> check for something funny. A good idea...

> I mentioned this because I had users inadvertently (bad command in
> console, kid hitting keyboard while renaming...) renaming folders to a
> "dot", or just a space.

Interesting kind of error. :-)

>> I had someone help me with those recently [unfortunately]. Recovery
>> was only partial - many came back with 0 size or corrupted. With
>> 400,000 files, though, the biggest problem was trying to find the 300
>> or so 'missing' files not in the last backup. Essentially impossible
>> to do manually.
> Recovery is always a tedious process.

I'd use 'teeeeeeedious' to describe it more accurately... :-)

>> 
>> What I needed was a tool to compare the two sets and ID the 'missing'
>> ones in the recovery set, and ignore the ones that were the same. If
>> you have a suggestion for how to do that, please let me know - I may
>> need to do that again.
> I'd start by computing control sums of the files (md5sum or sha1sum),
> output it to files and diff those. Should highlight the missing ones.

Again a good idea - I'll try it. Before, many came up with size 0. Is
there a good way to filter out these before computing sums?

Other thoughts... Is there a tool that would low-level scan the disk
looking for the deleted dir name? If it would not take forever to do,
it might give a clue as the recoverability. When a dir is deleted, is
just the dir marked as deleted, or do all the files/dirs under it also
get marked as deleted? If just the dir, would it be possible to edit
the disk to undelete the dir?

>> If I use a live-cd instead, and mount the disk so I can look at it,
>> does that also allow the possibility of overwrites? An image takes a
>> long time to make, and the live-cd might be quicker.

> It's safe to work from a live-cd in your case as the disk isn't damaged
> or dying, just mount it ro (read-only). If the disk was failing it would
> definitely not be a good idea to hammer it with search and forensic tools.

When I tried that from the live-cd, it says only root can mount the
disk. The disk utility can mount/unmount it though. What do 'I' have
to do to mount it ro?

The disk is new - could this bring in the possibility of an early
failure even if 'smart' reports no problems?

Again, thanks!!

-- 

 rikona