doomclaw.de » ext3

Data recovered

skaven — Mon, 24 Aug 2009 07:40:52 +0000

I managed to recover the accidently deleted data. Due to the fact, that I recognized my mistake while the deletion process I unmounted the partition directly afterwards and made an image of it with dd.
After some searching on the internet I’ve found ext3grep. With one simple command everything was restored, since I knew the date of deletion.

ext3grep $IMAGE --restore-all --after=1250740800

This command restored all recoverable files from $IMAGE (which represents the path of my dd-Image) after Thu, 20 Aug 2009 04:00:00 GMT (referenced by the UNIX timestamp 1250740800).
Since I had unmounted the partition ther were no write actions after the deletion, so each deleted file was recoverable.

A lesson learned…

skaven — Sat, 22 Aug 2009 05:26:43 +0000

I got 2 Directories within my /home. One is named Backup (a mount-loop from my backup partition) which is really essential and the other one is named Backups (just a simple old webserver backup directory). So I wanted to delete the old Backups-dir and did a quick rm -r ~/Bac TAB ENTER which resulted in…, yes you’re right, rm -r ~/Backup…
Wondering why it’s taking so long to delete the 240MB in the Backups-dir I recognized what I did. Interruption of the rm-command rescued about 200GB of the files, just half of the whole partition.

Lesson learned: In Future I’ll keep my data somewhat more sorted and I’ll never ever again name 2 directories within the same parent dir that way.