Linux help

[cubby1223]

Got the word this afternoon that one of the businesses I do work for deleted an important file off their server. Well, lucky me nobody has changed tapes in the past week...

Is there a good way to recover deleted files? I remember with Novell Netware it was pretty easy to undelete files. This machine has SuSe, their last release with the 2.4 kernel, which I believe was 9.1.

I found some info about using reiserfsck to get files back. But there are enough warnings about making sure to back up all data first before using that command, that I have started a full backup. So this means I've got ~4 hours to kill & to see if there are any other options to undelete a file.

Thanks.

 

[drag]

Well if your using reiserfs and it has a undelete function.. then your lucky.

If you were using Ext3 or most any other filing system they do a aggressive form of delete that makes it virtually impossible to recover any information. This is on purpose.

If you were lucky and caught the unintended delete right away then you could take down the machine and hopefully get to it beofre it was overwritten with any new data.

Then you could boot up knoppix or whatnot then simply grep through the /dev/hda1 or whatever device your using and hope to find a character string that is contained in the file you want to recover.

then it's a matter of going through and manually copying and saving as much as the data as you can find.

This is something that is done as a last ditch attempt...

After that you can pobably pull the drive and take it to a professional data recovery place and they could possibly rescue part of your file if you pay them enough.

Just remember that the longer you use the system after it deletes something the less likely you are to recover it.

However generally there is no undelete. Once it's gone, then it's gone forever.

 

[cubby1223]

Alright. We've got five tapes, and discounting the one I'm using right now for a backup, I'll probably be able to get it off one of the other 4, just a matter of how old it is & how much data will need to be re-entered.

I wonder why linux doesn't offer an undelete option. I guess you could put it under "security concerns" - but in my mind it's far more likely someone is going to accidently delete a file than someone hacking in & trying to find those deleted files.

 

[drag]

Well actually for ext3 it's more for data (or actually metadata) integrety, but it's also for security.

With ext2 there was a undelete option, but ext3 overwrites the inode records for deleted files with zeros to ensure better data recovery in event of a crash or a something like that. File system internals are just something I don't know much about, but they have a very good reason for it.

But then again your using reiserfs, not ext3, right? The reiser folks have different ways of doing things... but then again there is a very good reason why ext3 is much more widely used then reiserfs v3 or v4. (mainly it has better data protection mechanisms and higher reliability and is more mature)

Sorry, good backups are a must. Even if they had a undelete feature for ext3, there is no way that it would ever be reliable enough to depend on. (there would only be a short time were it would exist before getting overwritten)

edit:
Here is a informative page on the subject.
http://linuxmafia.com/faq/Filesystems/ext3-no-undeletion.html

edit2:
on the same site, why ext3 does stuff differently then things like Reiserfs and XFS, which themselves (moreso xfs) are actually good file systems.
http://linuxmafia.com/faq/Filesystems/reiserfs.html

 

[cubby1223]

The lightbulb finally lit up when I thought of the hardware mirroring. So I cancelled the tape backup, disconnected one drive, ran the reiserfsck command, and it worked! I got the file back that was deleted, and copied it to another machine. Switched hard drives, booted up & copied the file back onto the server. So tomorrow evening I'll go back and take the time to make sure I don't rebuild the array backwards.

I'll have to talk with them about making sure to replace the tapes each day. It's always the same story, though, they're good at it for a couple months then they start to slack off - until it comes a time they need to recover a file and the last backup was 3 weeks ago...

I'll give those links a read, I do need to be more knowledgable with all things linux. Thanks for the help.

 

[drag]

What you do is that you need to figure out how to have it automaticly e-mail you and their boss when they forget. Or something like that that may be more threatenning.

Or maybe make it make annoying beeps and such when it wants a tape.

Basicly make it more of a hassle not to replace the tapes then it is to replace it.