Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[HOWTO] ReiserFS undelete/data recovery
View unanswered posts
View posts from last 24 hours

Goto page Previous  1, 2  
Reply to topic    Gentoo Forums Forum Index Documentation, Tips & Tricks
View previous topic :: View next topic  
Author Message
zurd
Apprentice
Apprentice


Joined: 17 Dec 2003
Posts: 228
Location: Canada, Montreal

PostPosted: Fri Nov 03, 2006 10:03 pm    Post subject: Reply with quote

First, you have to use "cat /dev/hdaX | strings > /here/some_large_dumpfile"

This will create a huge file that store only text. So if you want to get back a file in it, you have to know at least one word that was in the file. Let's say the word was foobar, so you now use "cat -n /here/some_large_dumpfile | grep foobar" this will print only lines with foobar and the -n option from cat will print the linenumber.

Let's say it returns 4000, you now use "cat /here/some_large_dumpfile | head -n 4100 | tail -n 200" and this will print only lines 3900 to 4100, first head will print lines number 1 to 4100 and tail says return only the last 200 lines, so 4100-200 = 3900. Of course if the file is larger or smaller just modify the numbers.

Of course if you have 50-100 files to get back, this method is sure to be time consuming unfortunately. Maybe the second method I posted will be more useful.

Code:
dd if=/dev/hda1 of=/tmp/backup.dsk
losetup /dev/loop5 /tmp/backup.dsk

reiserfsck --rebuild-tree --scan-whole-partition /dev/loop5
mount /dev/loop5 /mnt/tmp


But then, this will create like 10,000 files and folders with random gibberish name for files and folders, it might be even more time consuming to look through them to find what you're looking for. If it's movies it's quite simple, just look for files larger than 700 MB but for small files, it's more complex. Maybe if you could "cat" all of the files and "grep foobar" and if it's succesful then return the path and filename but I have no idea how to do it... maybe someone else have a suggestion.

As for me when I deleted the file accidentally, I just wanted to recover 1 small file, so method #3 was fine.

Good luck, and make sure from now on you do backup regularly and put alias rm="rm -i" in your ~/.bashrc! :wink:
Back to top
View user's profile Send private message
skybaba
n00b
n00b


Joined: 03 Nov 2006
Posts: 3
Location: London

PostPosted: Fri Nov 03, 2006 10:50 pm    Post subject: Reply with quote

zurd,

Thanks so much for the clear and speedy reply. I'm still not quite sure what to do with a file once it's printed. I need it extracted to somewhere so that Gnucash can open it. Meanwhile I'll get on with the next stage. Cheers, enjoy the weekend.
Back to top
View user's profile Send private message
zurd
Apprentice
Apprentice


Joined: 17 Dec 2003
Posts: 228
Location: Canada, Montreal

PostPosted: Fri Nov 03, 2006 11:52 pm    Post subject: Reply with quote

Easy, once you got the right line numbers with "cat file | head -n XX | tail -n XX" you just use that same command like this "cat file | head -n XX | tail -n XX > /your/file/here" and instead of printing the file on the command line, it will print it in a file.

After that, move the file where it's suppose to be. I never used gnucash but I bet the settings file are located in ~/.gnucash, just type "cd ~" and "ls -a" and look for something like ".gnucash"
Back to top
View user's profile Send private message
skybaba
n00b
n00b


Joined: 03 Nov 2006
Posts: 3
Location: London

PostPosted: Sat Nov 04, 2006 12:41 pm    Post subject: Reply with quote

Cheers zurd, got it - thanks for all the attention.
Back to top
View user's profile Send private message
JustJoe
Tux's lil' helper
Tux's lil' helper


Joined: 30 Jul 2005
Posts: 80

PostPosted: Thu May 24, 2007 1:06 pm    Post subject: Reply with quote

Hi,

Aw, i wish i did some more research or read this thread before i went on with undeleting some files i accidently deleted.
I undeleted files on / using a livecd, but i did not make an image first. So now my gentoo doesnt boot anymore, it hangs on 'Freeing unused kernel memory: 248k freed'.

I already tried `reiserfsck /dev/hda3` from a livecd, but that returned zero errors.

So, i guess i hosed my install ? Can it be recovered or do i have to go for a fresh gentoo install ?

Any help much appreciated!

NVM. It's hosed. Real good. Reinstalling right now.
Back to top
View user's profile Send private message
veal
n00b
n00b


Joined: 08 May 2003
Posts: 47

PostPosted: Sat Mar 15, 2008 12:56 pm    Post subject: Reply with quote

yeah, me too :D

accidently deleted an unimportant directory (if you once a month use konqueror instead a terminal... rightclick->delete on wrong dir is crucial), then googled for undelete and found that same thread as the OP.

unfortunately, i didn't really read the manpage as the tutorialpage looked serious and it didn't warn me about anything.
long story short:
- i saw it takes lightyears to finish the command
- deleted dir wasn't important (and log was empty so far)
- i aborted ^C ( probably 2mins into running the command)
- step5 (mounting):
Code:
$ mount -t reiserfs /dev/hdb1 /fata
mount: Not a directory


i don't know whether the abort was the culprit or the same would have happened if i had it run through... but just a tip ;) make sure you got a back up
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Documentation, Tips & Tricks All times are GMT
Goto page Previous  1, 2
Page 2 of 2

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum