Recovering Deleted Files on ReiserFS3? 126
DarkSarin asks: "I have a rather serious problem: I managed to accidentally delete some files (rather important ones at that!) while trying to back them up to cd (I was using a GUI burning software that will remain nameless for now). How do you recover accidentally deleted files in Reiserfs? This thread (started by me) indicates that you can't recover them. Note that I had found a way to rebuild the tree, but that didn't work. It seems odd to me that you wouldn't be able to recover accidental deletions, but that really does seem to be the case. Help? Please?"
Happened to me the other day with ext3 (Score:1)
Re:Happened to me the other day with ext3 (Score:3, Interesting)
Depending on what you want to undelete, you can always do a grep -a -100 STRING
Solution (Score:3, Informative)
Re: (Score:1)
Re:Solution (Score:2)
I'm not sure, you'll have to ask Enstein since it's his quote. Actually, that's not the entire thing, slashdot cuts signatures at a 120 characters and I haven't bothered to change it. The entire thing is:
"Put your hand on a hot stove for a minute, and it seems like an hour. Sit with a pretty girl for an hour, and it seems like a minute. THAT'S relativity." --Albert Einstein
Try GtkRecover and Recover (Score:2)
IT's even a GUI for the CLI adverse. It's for recovering ext2/ext3 filesystems via a node grab by date method. I've used it many times to recover deleted files quickly. Also there is the lazrus toolkit, but I haven't personally used it.
I've personally written some simple tools to recover MS Office and RTF files, which is just a little more advanced than grepping a raw device. However, it also handles partial partition recovery this way -- like if you're recovering
Good luck... (Score:4, Interesting)
The reason for this is that a recycle bin is to save you from accidental deletions. If you delete a file from the nice, big, friendly GUI, it usually asks you at least once whether you want to delete it, then instead moves it to the trash. When it's time to empty the trash, it asks you again to make sure you're not screwing yourself over.
However, many programs create temporary files and then promptly delete them -- so many times that it would be ridiculously inefficient (both in space and fragmentation levels) to put them into the trash. Furthermore, can you imagine looking for your files in the middle of all sorts of files with names like 11025u012348512i51253.tmp?
As someone said on the other forum, there's the hard way -- grep for it on the raw partition. This may not even work with ReiserFS, I'm not sure. The usual way to protect yourself from this is to back up in the first place (yeah, I know) and to only run programs you trust as a user that can delete files that you need.
I would suggest that you try the grep method, and if that doesn't work, learn from it. The safest way to do this is (ironically) the command line. If you type "cp", you know for sure it will copy the file. If you type "mkisofs" or something similar, it is very unlikely that it will delete the files. And these tools (along with mv, which does delete the old copy after the new one is successful) have been around for so long and are so simple that the only way you could screw this up is through a very stupid mistake (like rm instead of cp) or using an experimental filesystem, which despite the opinion at Gentoo, ReiserFS is not.
Re:Good luck... (Score:4, Interesting)
What use is "empty" disk space? The OS might as well use it for something, as long as it can ditch things that aren't important if there is a demand for space. As for your temp file issue, it's easy enough to just make
Modern file systems don't need to have a limited number of inodes. Even ext3 by default creates way too many inodes on large file systems, if you are going to be storing files of any significant size.*
I think it's high time for filesystem reform, and it doesn't need anything revolutionary like databased buzzword filled paradigm shifting crap. It's just logical evolutionary improvements.
*And it wastes 5% of the space by default! That's 100 GB on a 2TB fs completely wasted! Always use -m0 on storage fs's or -m1 on system fs with mke2fs. Use -T largefile4 to make one inode per 4MB, which is fine for storing "large" files. Otherwise the fs takes hours to create all those damn unnecessary inodes on a large fs.
Re:Good luck... (Score:2, Insightful)
Periodic backups are a much better answer.
Schemes like this would also require the fs to delete old files when the space is needed, but this is what is done now. The data is still there until the space is used by something else (and even after that for all of you super security freaks). Given, the choice of
Re:Good luck... (Score:1)
Zorton
Re:Good luck... (Score:1)
Re:Good luck... (Score:1)
Re:Good luck... (Score:1)
Except this is what caused the problem in the first place.
Re:Good luck... (Score:1)
Until someone trys it, someone who is a real file system whiz, not some hack, we won't really know just how reasonable it is.
That's the way computer science works; 1000 people say you can't do it, but one person does it, and it works, well, and suddenly everyone changes their opinion.
How many people, for example, really expected SGI to clean up XFS enough to merge into the official kernel?
I think it can be done. I can contemplate an algorithm that balances delete recovery
Re:Good luck... (Score:3, Informative)
On the other hand, I agree that a marked for deletion queue makes a gre
Re:Good luck... (Score:1, Informative)
tune2fs can fix that after creating the filesystem. But it's not wasted space, it's just reserved for root (or another user ID, if you change it - useful as a cheap quota system).
ReiserFS v3 and v4 are pretty good with space efficiency. No space is reserved for inodes, and tail-packing means very little space is wasted storing the last block of a file.
Re:Good luck... (Score:2)
Re:Good luck... (Score:1)
Re:Good luck... (Score:2)
Re:Good luck... (Score:2)
Linux is one (though not the only) OS that handles this properly, when VM is needed it's turned on, after that it stays on awhile. If you are doing something that requires alot of ram you onl
Re:Good luck... (Score:2)
Since only x% of inodes change, you don't need to duplicate the whole storage, just the modifications. I think plan nine did something similar with a WORM drive. They reported capacities growing faster than they could fill it -- probably
Re:Users are too clueless to hit this problem (Score:2)
From my experience Reiser has better average case read and write performance and XFS has better worst case performance (very useful if you are doing something time critical). I'd comment on JFS and ext3 but I havn't used them as heavily.
The real benefit of Reiser is going to be atomic operations (when apps get around to supporting it).
Re:Good luck... (Score:1, Insightful)
As to files being created and destroyed frequently, this is why we partition into at least:
/
swap
obviously var and tmp would not be a place to version files.
you could consider the use of versioning in a place like
NetWare has... (Score:1, Informative)
A filesystem has never (AFAIK) implemented a trash / recycle bin folder -- not on Windows or OS X, and not on any UNIX that I know of.
NetWare has had a very sophisticated file undeletion capability since time immemorial.
If Novell ports it to SuSE, you Linux clowns might just find yourselves in possession of a mission-critical operating system after all [not that you deserve it].
Re:NetWare has... (Score:2)
Learned a lot more about the NW file system then I really wanted to know at the
Re:NetWare has... tsarkon agrees with use of clown (Score:1)
Re:Good luck... (Score:2)
[drum roll, please]
LVM!
It will keep a frozen in time snapshot of the drive at a given time until it runs out of COW space (copy on write). The space dedicated to snapshots are not seen by the filesystem, and when the filesystem is changed after a snapshot LVM copies the modified data away to the snapshot dedicated area. (I guess you could call the snapshot reserve a "Secret Cow Level".
You can run multiple snapshot
Re:Good luck... (Score:4, Informative)
I will point out that the filesystems included in Novell's Netware product did include a deletion-recovery tool, accessible via the salvage command. My understanding was that Netware would not permantently delete a file until that disk space was needed for active data or until a timeout period expired.
Damned handy tool, too. We had IBM's TSM for our major backup operations, but for those "oops" moments, salvage was sure handy. I hope that the new Novell might consider implementing those features on existing linux filesystems, or at least contribute native linux implemenations of their filesystems.
Re:Good luck... (Score:1)
Actually, there is an OS that lets you specify that a file is temporary, though I can't remember offhand which one (VMS? NT? OS X? dragonfly BSD?). Or maybe I'm thinking of SQL - for small temporary tables, you can often have them stored in memory.
Anyhow, you could add an fcntl flag to indicate a file i
Re:Good luck... (Score:1)
Re:Good luck... (Score:2)
Re:Good luck... (Score:2)
Re:Good luck... (Score:3, Informative)
Actually, OS/2 implemented it. It could be enabled/disabled per drive, the size of the trashcan could be configured, and it worked even for temporary files made by programs. And yes, it was somewhat slow.
Some file systems do have a trash can actually. (Score:2, Informative)
Re:Some file systems do have a trash can actually. (Score:2)
Use some aliases (Score:2)
Once upon a time Norton even sold undelete for Unix, ULTRIX maybe. Before Norton was part of Symantec, of course and Peter Norton did more than pose for pictures. (yeah, I'm just envious)
Stop!!! (Score:5, Interesting)
Then use dd to copy the partition to another partion/disk. Then mess with the copy.
A lot of silesystems do a good job at keeping files and their blocks in order. I've had luck with *BSD file-system by grepping for somthing at the begining of the file and grabbing a big chunk of data afterwords. This works great for MS Office Documents, JPEG or anthing that begins with a known preamble.
This may not work for your filesystem.
Re:Stop!!! (Score:2)
The Coroners Toolkit (Score:1, Interesting)
This may help..
TCT is a collection of programs by Dan Farmer and Wietse Venema for a post-mortem analysis of a UNIX system after break-in. The software was presented first in a Computer Forensics Analysis class in August 1999 Examples of using TCT can also be found on-line in a series of columns in the Doctor Dobb's Journal. Notable TCT components are the grave-robber tool that captures information, the ils and mactime tools that display access patterns of files dead or alive, the unrm and lazarus tools t
Re:The Coroners Toolkit (Score:4, Informative)
More questions... (Score:3, Insightful)
Re:More questions... (Score:1)
If a certain sequence of bits on the disk was originally 1011010010001011101001, and it got overwritten with 0110101101010010101111, how -- barring psychics, voodoo, and fairy dust -- can the original be recovered? Simpler case: a certain bit used to be 1, it was overwritten a few times. How do I know what it was (let's say non-journaled filesystem) before being overwritten?
Mayb
Re:More questions... (Score:3, Informative)
By reading the slop in between tracks. The writes look more like layers, with little bit of data poking out from the edges, to a scanning electron microscope.
Think of paint layers - at the edge, you can somtimes pick out the previous colors and the order that they were painted.
Of course, this
Re:More questions... (Score:1, Funny)
** as long as you have access to the CIA tech to read the old bits
Re:More questions... (Score:3, Informative)
Except that they don't. It's entirely a myth that the CIA can read multiply-overwritten data from hard disks. The idea that the tracks look like layers doesn't hold up - you'd have to use less and less write density every time. It doesn't happen that way.
Now, what you can do - and what does work - is look at the analogue signal from the head and see what the variance from an "average" one or zero is. So, if the head returns a 4mV pulse for a one, on av
Re:More questions... (Score:2)
Re:More questions... (Score:2)
Re:More questions... (Score:4, Informative)
Re:More questions... (Score:1)
Name the program please (Score:2, Insightful)
Re:Name the program please (Score:1)
Reminds me of LoneTar, which helpfully will tell you that
The reason is because
Re:Name the program please (Score:3, Informative)
> Was a user error? Was it a bug? Is the bug being worked on?
I'm not poster so I don't know the answer to your question, but I will say I've accidently done this in K3b. I had files highlighted in the list of files to burn, AND there were files highlighted in the tree view of my filesystem. I hit the delete key thinking it would remove the ones from the list of files to bu
Re:Name the program please (Score:4, Informative)
To the user who gave instructions on how to use rebuild tree, those are about the same steps
I used (same -S option) on --rebuild-tree, to no avail.
So, the end result is--thanks, but so far the best advice still seems to be to pay the $25 to the folks who made the fs. I may yet do that. In the mean time, I am using my sorry winXP install....
blech
Re:Name the program please (Score:2)
Re:Name the program please (Score:2)
Suddenly... (Score:5, Insightful)
(No, that's not really a troll. Human error happens.)
Re:Suddenly... (Score:1)
As an amusing anecdote, I once was writing a rudimentary file manager when I accidentally deleted all my source! After locking down my filesystem and learning how to undelete files, I realized that
Re:Suddenly... (Score:2)
Re:Suddenly... (Score:2)
Google the LVM snapshots, and if the frequency is high enough, you'll only lose a little time's worth of ze data.
Re:Suddenly... (Score:1)
Re:Suddenly... (Score:2)
Re:Suddenly... (Score:3, Insightful)
The recycle bin only works if it's a well-behaved GUI app.
Do this...
START->RUN->COMMAND and hit enter.
type in
DEL c:\*.* and hit enter.
If you're asked any questions - say 'yes'
Now.... Try to find your files in the "Recycle Bin."
Re:Suddenly... (Score:2)
Re:Suddenly... (Score:3, Insightful)
Re:Suddenly... (Score:1)
Norton Utilities includes an extension to the command line so things deleted there (or anywhere via whatever non-Recycle Bin API they use) will also go to the Recycle Bin.
OTOH, it fills the 'Bin up pretty quick, since lots of apps create and delete many temporary files, and you normally only want the things you've interactively deleted.
Re:Suddenly... (Score:3, Insightful)
Re:Suddenly... (Score:2)
(Luckily, I had the editor set to be making backups, which were OK)
Well...to be fair. (Score:1, Informative)
But in the context menu it asks you if you want to delete or move to trash. Not the same thing! In DOS, delete, or del usually just write a lowercase delta IIRC over the first character of the file name marking the space as free to be used.
Right now, his enemy is the "relatively" obscure file system, and how much writing he's done to the harddrive since the "incident".
Re:You again! (Score:1)
Re:You again! (Score:1)
Uncheck the "Display delete confirmation dialog" option in the Recycle Bin properties page.
First thing I do on a new Windows install... followed by deleting all the worthless crap on the FS that Windows thinks I need ("Online Services" and such).
Re:You again! (Score:1)
Re:You again! (Score:2)
Re:You again! (Score:2, Insightful)
Re:You again! (Score:2)
Ok, I've been caught out a few times...
1) Shift
2) Delete
3) Notice WHICH file got deleted...
4) Panic/swear
Tiggs
Alias 'rm' for console work (Score:2)
To clear the trash, you have to use 'rm' unaliased. Normally, you can't do such a thing by accident
Try this (Score:5, Informative)
If you're really really desperate, you can do what I did a few weeks ago. In my \
case, fsck didn't recover the partition either, indeed it crashed. So here's what's \
I did from the beginning of what I think fixed it:
1) reiserfsck --rebuild-tree
2) mount
3) reiserfsck -S
4) debugreiserfs to get metadata for Vitaly
5) mount
6) mount again
I'm not sure why this happened, but after the second mount, the partition was not \
recognizeable as ReiserFS anymore. I suspect it had to do with a few really huge \
files that were originally on the partition that reisefsck -S tried to recover. In \
doing so it probably hosed lots of stuff. Now, it was as simple as
7) reiserfsck --rebuild-tree
And I had most of my data linked under lost+found! Took me a few hours to sort \
through it all but I got back most of what I cared about. Maybe if you use the new \
pre8 fsck you won't need to jump through these hoops. Since the potential for data \
destruction is high here, I wouldn't blame you for not trying. And yes, this all \
happened by trial and error
This might help too
http://marc.theaimsgroup.com/?l=reiserfs&m=104861
Good luck!
Re:Try this (Score:2)
Ever heard of macros? xclip?
Re:Try this (Score:2)
reiserfsck --rebuild-tree -S -l rebuild.log
after taking the disk offline (umount
I then (after waiting a long time for it to finish) checked the lost & found dir, and got nothing useful (although it did pick up some stray music files that I don't know where they came from!).
Ask Namesys (Score:5, Informative)
http://www.namesys.com/support.html
likely response: (Score:2)
The way i did it (Score:4, Informative)
I beleive i used the --rebuild-tree option. You should follow the steps in the manpage under Example.
so in short, man reiserfsck before asking slashdot
Re:The way i did it (Score:2)
And how the *heck* did you get 20 years of digital photos? I assume some were scanned......
From History [about.com]:
Re:The way i did it (Score:2)
Re:The way i did it (Score:2, Flamebait)
*Smack!*
"I don't make backups" is computerese for "I have no important data which I can't either reconstruct or re-download."
If you can't make that claim, then it's time to reexamine your backup policy.
Re:The way i did it (Score:2)
Re:The way i did it (Score:2)
The keyword there is consumer-level.. don't make assumptions.
Backup? (Score:1)
Real users never make backups!
-K
Re:Backup?? (Score:1)
Let me be Mr. Barn-door-closer.... (Score:3, Insightful)
I haven't done this yet (I'm lucky! I have a real tape drive [inostor.com] to backup my stuff.....) but I plan to make my system take a snapshot every hour and every day (total of two) so that at most I lose an hour's worth of work.
Also, I've always wondered if it was possible to make an operating system that would take as long to destroy something as it did to create it. For example, your term paper took ten days to write, so the rm termpaper.tex command would take ten days to run
Re:Let me be Mr. Barn-door-closer.... (Score:2)
Good old UFS is close. A reoccuring job we run at work creates around 50000+ new files and directories, does a quick rename, and then deletes 50000+ old files and directories. This takes a looong time. The funny thing is, the delete process takes *
deleted filesystem, NTFS, ext2/3... (Score:1)
Best advice here is to keep active backups (Tape/CD is good for archival), if the files are small (docs/text/logs/source code), HD space is dirt cheap, get another drive (or partition)
mount as something like
and set rsync/cron/whatever to copy the files f
Re:deleted filesystem, NTFS, ext2/3... (Score:2)
Stop mucking around (Score:3, Interesting)
_Either_
- you fucked up, be a man and admit it's your fault;
- the software fucked up, in which case let others know what it was and how it fucked up so that they can avoid risking the same bug.
YAW.
Re:Stop mucking around (Score:2)
Wow this is so easy I'm surprised no one got it (Score:5, Insightful)
How do you recover accidentally deleted files in Reiserfs?
It's really easy. You just restore from backup.
Script for emergency file recovery (Score:2)
tr </dev/hda '\n' '~' | tr '\0-\37\200-\377' '\n' | grep "while (mungeCount < superMungeCount) {" | tr '~' '\n' >foo-recovered.c
This does have its problems. If the file spanned multiple blocks it may not get all of it, but you'd be surprised how
Re:Script for emergency file recovery (Score:2)
Like I said, these were important files.
Re:Script for emergency file recovery (Score:2)
In any case, DO NOT run anything from the relevant filesystem and especially DO NOT MOUNT the filesystem rw.
Odd??? (Score:2)
Why would this seem odd? None of the most widely used file systems allow for undelete. If you think the recycle bin is undelete try del *.* and then see what you can recover. The only one that really supports undelete, and does it really well, is Netware's Salvage utility.
There are kludgy solutions for FAT and NTFS but there really isn't a true deleted file recovery system in any of the mainstream file systems. That includes ext
Remember undelete in DOS? (Score:1)