deviant art

Deviant Login Shop  Join deviantART for FREE Take the Tour
[x]
more ▶

Featured in Groups:

Details

May 18, 2012
Link
Thumb

Statistics

Comments: 1
Favourites: 1 [who?]

Views: 357 (0 today)
[x]

Prologos


At first there was fright. No one can predict when he/she will make a slip :ohnoes:.

But when the first impression has gone a logical thinking taken its place.
It told me that in no file system data are erased permanently. Files when "deleted" are marked with tombstones, and if nothing was written after that, you can unmark them therefore "recover them from death" :).

Unfortunately in my case the installer done some writhing. But my files were over 100GB large, so there's a little chance all of them went off.

So, the point was to get and learn some utilities which can find'n'recover tombstones from a disk partitioned with ext4 journal :plotting:

Act 1


My first program I used was debugfs, a standard utility for maintaining disks and partitions with ext2/ext3/ext4. As I suspected it was able to unmark all unlinked nodes (in linux terminology: files/folders unreachable from any other folders). But first I had to find them one by one, because the program didn't know about e.g. sub-folders until I haven't linked their super folder first.

But there was a catch: Imagine a disk is like an Internet site. Folders are pages with links, and files are...files :shrug:. If you want to view a file you can enter its name directly in the address bar or by clicking on links through folder-pages until you find a link into the file.
Of course, if someone delete a folder-page which is in your way to the file you will not reach it unless you talk with the address bar.

That's what happen in my case: an i-node with the folder to my documents was erased (overwritten), so I couldn't find my files :(. Not with debugfs at least. I need a tool which can find files without any reference...

Act 2


The next program I found was scalpel, but at first I had to install it, which was little or no trouble (I ran Debian Live, so nothing was written on any disk, because everything can work with ramdisk).

The program welcomed me with an information it can't recover filenames, only their contents, so to know I will end up with tons off "fileXXXX"-s. But a bird in the hand is worth two in the bush, so I haven't argued with it :eager:. On the other hand, the tool can recover pictures (not like if I'm complaining...) and almost nothing more than it (which I could complain...).

Anyway, I ran it and the program did...well. A bit too well :O_o:. It recovered files which was deleted in any time during the disk usage :faint:. So now I have a really big mess: among the files are some of my files, but at first I must dig down to them... Most of the other files comes from browser's cache (during this time I got a small disgust for your avatars, because they were there in all possible versions: full, half-downloaded, erroneous, blank, old, etc...) or others unidentifiable sources (for example I found a PDF manual for a game I never ever installed, not ever I had read about it in any web page or something :confused:).

Of course, I keep them all because, well, something came back by this way :la:.
But before I will consider the disk as ready-to-install, first I need to try other ways too. Maybe there is also some which will be able to recover names or even entire folder structure too :fingerscrossed:. An ability to find more data would be also great...

Act 3


I went fishing farther in the Internet and I've got something: extundelete :sherlock:.

Its man page gave me many promises: it says as long as a partition has got an ext4 file system (check...) with a journal (check...) it can read filenames and restore them with the right placement (che...WHAT?) and filter them to restore only files deleted after a specified date (:wow:).

First I had to compile it, because it hadn't a ready-to-use version, which made some trouble (but I got over with them).
When I could finally run it, it did...well. Very, VERY well! :dance:

Indeed, I recovered my home folder as-it-was with right folders in right folders (some of them had wrong name thus...). And it wasn't limited to pictures only :).

Still yet, it wasn't enough for me: yes, there was many files, but some folders was prim empty :iconblackholeplz:.
But scalpel shown me there is still many to recover, so I checked if I can do more with this tool.

Act 3 1/2


I read manual once again and it told me it is an --restore-all option, but like the scalpel it can't guarantee a file will have got a name more sophisticated than a number. As you may guess I ran it anyway, because there could be only better, not worse.

The result was not so bad, but not so good too: Almost all files was named with right names, just they wasn't put in their right folders.  It is enough to put them manually, as I can remember where they were :).

Act 3 3/4


Then suddenly I got an idea: since now I used my family's remote disks to make backups every time I was going to refresh my laptop.
Because these disks are used by the whole family, I never could leave them there, so I had to delete backups after full refresh.

So then, what if I do recover backups from them too? :idea:

Quickly I made this idea into a real thing. And...there were some data! :dance: Just a bit and in old versions but it is still better than 'nutin.

Eksodos


So, I ended up with some of my files restored. That's a good thing :).

But I must say too there are some K.I.A.-s:
  • Things I made during study at university — Projects, writings, and programs. Especially I miss one program I made to speed up compose, re-editing, and do necessary computing for reports (It has got some bugs, but even with them I was able to write reports much quicker than my professors could check them!). There was also copies of books hard to reach out of university :doh:.
  • The Vojnic language — nothing was survived, so the references here on DeviantArt are the only ones left :omfg:. No words, no grammar ideas, no font (the last one I did: now I have to redo it using the image you saw a few days ago).
  • A LARGE contingent of reference pictures —  I'm a pretty pack rat, I like to download pictures which may be useful as a reference in the future. Over these 3 years I had a plenty of different pictures, so to never worry if I do know what I'm drawing. They also gave me sometimes an idea for a new picture.

    Still ~300MB have survived, but I had got a much more...
  • Music — maybe not a big loss, because much of them I copied onto my MP3 player (I did an accidental backup :)). But there was some music I got from dudes and ladies of #draconisArt (Hi! :wave:). Maybe I will ask them at the upcoming con...:plotting:
  • Sketches and WIP-s of my pictures — I do them a lot, and not always finish them. But I keep them in case I got a new zeal to draw or a new idea for them. No one survived, so I must find some other ideas (anybody help?) :work:
  • Browser settings — this one may be a serious problem, because it had got also my passwords... :oops:
  • Instant messenger settings — I know I talk through them much rarer than Chuck Norris does a full-turn kick, but now I may do it even much rarer, because I don't remember IM number nor the password :ohnoes:. Oh, and my friends' IM numbers too...
  • Other things I don't remember now, but surely I will miss them in the future :paranoid:.
:icongzegzolka:
Szkoda tych referencji i muzyki, szkoda szkiców, ale dobrze że się udało choć cześć odzyskać.
Reply
Add a Comment: