Dir gone - how to get it back?

[tv.debian at googlemail.com]

On 15/05/2013 23:25, rikona wrote:
> Wednesday, May 15, 2013, 9:50:11 AM, tv wrote:
> 
> <snips>
> 
[trim]
>>>
>>> What I needed was a tool to compare the two sets and ID the 'missing'
>>> ones in the recovery set, and ignore the ones that were the same. If
>>> you have a suggestion for how to do that, please let me know - I may
>>> need to do that again.
>> I'd start by computing control sums of the files (md5sum or sha1sum),
>> output it to files and diff those. Should highlight the missing ones.
> 
> Again a good idea - I'll try it. Before, many came up with size 0. Is
> there a good way to filter out these before computing sums?

You could play with find like this:

find ~ -size +0k -type f -print0 | xargs -0 sha1sum 2> /dev/null >
SomeName.txt

Command is one line, mind the email wrapping. May be further refined.

> 
> Other thoughts... Is there a tool that would low-level scan the disk
> looking for the deleted dir name? If it would not take forever to do,
> it might give a clue as the recoverability. When a dir is deleted, is
> just the dir marked as deleted, or do all the files/dirs under it also
> get marked as deleted? If just the dir, would it be possible to edit
> the disk to undelete the dir?

Look into "extundelete" man, you will find what you are looking for I
think, like the "--restore-directory" and "--restore-files" options.


> 
[trim]

> When I tried that from the live-cd, it says only root can mount the
> disk. The disk utility can mount/unmount it though. What do 'I' have
> to do to mount it ro?

Which live-cd ? From an Ubuntu live-cd just use:

sudo mount -o ro /dev/your-device-partition /mountpoint

If it has been automatically mounted (bad for recovery), remount it ro:

sudo mount -o remount,ro /mountpoint

> The disk is new - could this bring in the possibility of an early
> failure even if 'smart' reports no problems?

It wouldn't be the first time a new disk fails ! But if "smart" or
"badblocks" doesn't complain it's probably not the case, unless the disk
is too new and as a weird smart implementation.

HIH