Tag Info

Hot answers tagged

38

I would advise against immediately installing some utility. Basically your biggest enemy here are disk writes. You want to avoid them at all costs right now. Your best bet is an auto-backup created by your editor--if it exists. If not, I would try the following trick using grep if you remember some unique string in your .tex file: $sudo grep -i -a -B100 ...


26

rm /* should delete very little. There is no -r flag in there that would recursively delete anything, and without it directories will not be deleted (and even if directories were deleted, only empty ones can be deleted). This answer is predicated on the assumption that you did not run rm -rf /*. The only files in the root filesystem of consequence may be ...


21

It sounds like you've got a decent grasp on what happened. Yes, because you hard-powered-off the system before your changes were committed to disk, they were there when you booted back up. The system caches all writes before flushing them out to disk. There are several options which control this behavior, all located at /proc/sys/vm/dirty_* [kernel doc]. ...


18

If you need to recover files from the current install, ask your host to help you. Assuming it's a VM, it takes about five minutes of their day to image your disk, reinstall your host from scratch and dump the old disk image in your new filesystem. If you don't need anything, just get them to reinstall. Almost always the faster option when you bone things ...


15

Undeletion is becoming more and more of a myth esp. with modern hardware (SSD) where anything that is deleted is also zeroed out (TRIM) right away, so there is zero chance of getting anything back. Your best bet would be to make an image of whatever you have right now and then see if there is anything left to be found using whatever tools you wish. ...


14

It is possible, its just going to be a hassle. UPDATE: before you try this method, please have a look at Steven's answer You're going to need the testdisk package, a lot of disk space and a lot of time. PhotoRec, a part of TestDisk, can recover files from almost any disc. PhotoRec does support finding .tex files First, install testdisk by running ...


14

alias without parameter outputs the definitions of currently defined aliases. declare -f outputs the definitions of currently defined functions. export -p outputs the definitions of currently defined variables. All those commands output definitions ready to be reused, you can redirect their outputs directly to a new ~/.bashrc. All lists will contain a ...


13

First, from your experience with the second card, it seems that your reader is damaged and now damages the cards you insert into it. Stop using that reader immediately, and try to recover the card with another reader. If your data is at all valuable, try to get a brand-name reader with better quality than a bottom-price one. If the card is merely partly ...


11

First check the disks, try running smart selftest for i in a b c d; do smartctl -s on -t long /dev/sd$i done It might take a few hours to finish, but check each drive's test status every few minutes, i.e. smartctl -l selftest /dev/sda If the status of a disk reports not completed because of read errors, then this disk should be consider unsafe for ...


11

Your overwritten files are lost forever from that partition. Restore them from backup. Running Testdisk from a live CD might help a little; use the Testdisk live CD, which has a number of recovery tools. But be aware that recovery quickly gets difficult; it'll be quicker to recover your own data from backups, and to reinstall any third-party software from ...


10

First, never move a file across the network, only copy. You can always delete the original after the copy has been successfully completed. Secondly, your local system might not even be aware that a filesystem quota exists on remote storage - don't assume that it's even possible to guess ahead of time whether a copy operation would fail due to a remote quota. ...


10

If a running program still has the deleted file open, you can recover the file through the open file descriptor in /proc/[pid]/fd/[num]. To determine if this is the case, you can attempt the following: $ lsof | grep "/path/to/file" If the above gives output of the form: progname 5383 user 22r REG 8,1 16791251 265368 /path/to/file take ...


9

I use SystemRescueCd. It boots to a bash shell (where you can startx if you want) and can mount ntfs drives using ntfs-3g. It also includes a lot of rescue tools.


9

As with all things pertaining to security, there aren't any guarantees, but you also need to balance risk (and cost) against probability. From experience (and I've been running dozens of *nix boxen since the dark ages), I've never really had significant power-caused filesystem corruption. Some of these machines were even running on non-journalled ...


8

Of course in form they are very different but accomplish the same task. You should read the man page for rm (run man rm) so you understand what the options actually mean. The -r argument to the rm command refers to "recursive", meaning that not just the object you specifiy but any subfolders will also be deleted. The -f is for force, which means it doesn't ...


8

There's no way of knowing the best of your options without knowing exactly what is going wrong with the drive. If it's a mechanical failure, avoiding heating it up can help, but if it's due to errors in the servo data, heat isn't likely to matter. I would immediately start copying the unique data to the new drive with rsync. rsync will let you pause, ...


8

The kernel keeps the partition table in cache permanently (unless explicitly told to reload, and that can't be done if some of the partitions are in use). So you're safe until you reboot (or tell the kernel to operate on data that doesn't reflect the true disk contents; for example, if you've already activated mdraid, it might have written its metadata on ...


8

The link someone provided in the comments is likely your best chance. Linux debugfs Hack: Undelete Files That write-up though looking a little intimidating is actually fairly straight forward to follow. In general the steps are as follows: Use debugfs to view a filesystems log $ debugfs -w /dev/mapper/wks01-root At the debugfs prompt debugfs: lsdel ...


7

Many text editors keep backup files. If you are really lucky, there might be something like yourfile.tex~ including a previous version of your file.


7

You can use ddrescue or dd_rescue or myrescue to clone the failing disk, without aborting on any unreadable sector. (Myrescue is less configurable but has a better default strategy as it tries to skip over unreadable regions.) This will copy everything including blank space and won't let you set priorities. However, such a low-level approach has an advantage ...


7

You can use a tool like PhotoRec to read the blocks and try to recover files. It actually recovers a lot of file types, not just images like the name may suggest. http://www.cgsecurity.org/wiki/PhotoRec


7

I think that the simplest answer is that dd, dd_rescue and ddrescue are not designed to defeat copy protection schemes. They make no assumptions about the format of the data and try to maintain the integrity of the whole of the original on disk data. In the case of dd I suspect that it is terminating due to an intentional read error on the disk that is part ...


7

Using tail in follow mode should allow you to do what you want. tail -n +0 -f /proc/<pid>/fd/<fd> > abc.deleted I just did a quick test and it seems to work here. You did not mention whether your file was a binary file or not. My main concern is that it may not copy from the start of file but the -n +0 argument should do that even for ...


7

MacOS is a Unix OS and rm means "good-bye". The GUI interface allows you to move a file to the trash (which you can then recover) but that's not what you did. If you have a backup (e.g. you have Time Machine running) then you are saved. Clarification Strictly speaking (as @ire_and_curses points out) a rm simply deletes the directory entry for the file ...


7

It is actually possible if you have set a weak password with no key files. You also need a good GPU. This is done using brute forcing and dictionary attacks You can download a tool called Truecrack which does this at: https://code.google.com/p/truecrack/ Here is an article about it. ...


7

It sounds like the hard disk itself is having problems. ("short read," etc.) If so, dmesg | tail will probably show some I/O errors. Another way to check this is to run badblocks -n on the problem partition. Or better, on the entire disk. Whatever you test, it needs to be unmounted. This will take hours on a large modern disk. If there's anything on the ...


6

What you should try is the following: Use file command on the archive to see if it's recognized as gzip-ped data. Run strace gunzip on the file. This will print the last bytes read from the file which might help you identify the point in file where corruption occurs. Run a debug build of gunzip under gdb. Try to correct the corrupted section (you have to ...


6

First rule of disk recovery: Stop using the disk. If there are hardware issues (such as a head crash), any usage risks further damage; if the filesystem is corrupt, any mount or fsck has the potential to make it worse. (Even in ro mode! Note that mount -t ext3 -o ro will attempt to playback the journal and write to disk!) Use dd_rescue or ddrescue to ...


6

First off - stop the VM or remount the volume as read only: mount -o remount,ro /home/ Presuming you are using ext[3,4], you are not lost, but it's not an easy task. The data blocks themselves are not cleared, but the pointers (inodes) are. Most files can be recovered using tools such as photorec . It will identify a file based on it's magic number. ...


6

If a file has been deleted but is still open, that means the file still exists in the filesystem (it has an inode) but has a hard link count of 0. Since there is no link to the file, you cannot open it by name. There is no facility to open a file by inode either. There is no way to discover the file through its filesystem, and especially no way to look for ...



Only top voted, non community-wiki answers of a minimum length are eligible