Hot answers tagged

60

I would advise against immediately installing some utility. Basically your biggest enemy here are disk writes. You want to avoid them at all costs right now. Your best bet is an auto-backup created by your editor--if it exists. If not, I would try the following trick using grep if you remember some unique string in your .tex file: $sudo grep -i -a -B100 -...


33

The link someone provided in the comments is likely your best chance. Linux debugfs Hack: Undelete Files That write-up though looking a little intimidating is actually fairly straight forward to follow. In general the steps are as follows: Use debugfs to view a filesystems log $ debugfs -w /dev/mapper/wks01-root At the debugfs prompt debugfs: lsdel ...


26

rm /* should delete very little. There is no -r flag in there that would recursively delete anything, and without it directories will not be deleted (and even if directories were deleted, only empty ones can be deleted). This answer is predicated on the assumption that you did not run rm -rf /*. The only files in the root filesystem of consequence may be ...


21

The answer is "Probably yes, but it depends on the filesystem type, and timing." None of those three examples will overwrite the physical data blocks of old_file or existing_file, except by chance. mv new_file old_file. This will unlink old_file. If there are additional hard links to old_file, the blocks will remain unchanged in those remaining links. ...


21

It sounds like you've got a decent grasp on what happened. Yes, because you hard-powered-off the system before your changes were committed to disk, they were there when you booted back up. The system caches all writes before flushing them out to disk. There are several options which control this behavior, all located at /proc/sys/vm/dirty_* [kernel doc]. ...


21

You can use RPM to see what RPM that file belongs to: $ rpm -qf /etc/redhat-release centos-release-7-0.1406.el7.centos.2.5.x86_64 You can then fix it using yum: $ yum reinstall centos-release Might not work If the RPM that was used to do this install is no longer available then the above will not work: $ yum reinstall centos-release-7-0.1406.el7....


19

Looking at the usage guide on extundelete it seems as though you're limited to undeleting files to a few ways. Restoring all extundelete is designed to undelete files from an unmounted partition to a separate (mounted) partition. extundelete will restore any files it finds to a subdirectory of the current directory named “RECOVERED_FILES”. To run the ...


19

You have to check man passwd: If the encrypted password is set to an asterisk (*), the user will be unable to login using login(1), but may still login using rlogin(1), run existing processes and initiate new ones through rsh(1), cron(8), at(1), or mail filters, etc. Trying to lock an account by simply changing the ...


18

First, from your experience with the second card, it seems that your reader is damaged and now damages the cards you insert into it. Stop using that reader immediately, and try to recover the card with another reader. If your data is at all valuable, try to get a brand-name reader with better quality than a bottom-price one. If the card is merely partly ...


18

It is possible, its just going to be a hassle. UPDATE: before you try this method, please have a look at Steven's answer You're going to need the testdisk package, a lot of disk space and a lot of time. PhotoRec, a part of TestDisk, can recover files from almost any disc. PhotoRec does support finding .tex files First, install testdisk by running ...


18

If you need to recover files from the current install, ask your host to help you. Assuming it's a VM, it takes about five minutes of their day to image your disk, reinstall your host from scratch and dump the old disk image in your new filesystem. If you don't need anything, just get them to reinstall. Almost always the faster option when you bone things ...


18

If a running program still has the deleted file open, you can recover the file through the open file descriptor in /proc/[pid]/fd/[num]. To determine if this is the case, you can attempt the following: $ lsof | grep "/path/to/file" If the above gives output of the form: progname 5383 user 22r REG 8,1 16791251 265368 /path/to/file take ...


17

alias without parameter outputs the definitions of currently defined aliases. declare -f outputs the definitions of currently defined functions. export -p outputs the definitions of currently defined variables. All those commands output definitions ready to be reused, you can redirect their outputs directly to a new ~/.bashrc. All lists will contain a lot ...


16

Undeletion is becoming more and more of a myth esp. with modern hardware (SSD) where anything that is deleted is also zeroed out (TRIM) right away, so there is zero chance of getting anything back. Your best bet would be to make an image of whatever you have right now and then see if there is anything left to be found using whatever tools you wish. ...


13

First check the disks, try running smart selftest for i in a b c d; do smartctl -s on -t long /dev/sd$i done It might take a few hours to finish, but check each drive's test status every few minutes, i.e. smartctl -l selftest /dev/sda If the status of a disk reports not completed because of read errors, then this disk should be consider unsafe for ...


13

MacOS is a Unix OS and rm means "good-bye". The GUI interface allows you to move a file to the trash (which you can then recover) but that's not what you did. If you have a backup (e.g. you have Time Machine running) then you are saved. Clarification Strictly speaking (as @ire_and_curses points out) a rm simply deletes the directory entry for the file ...


13

MySQL stores DB files in /var/lib/mysql by default, but you can override this in the configuration file, typically called /etc/my.cnf, although Debian calls it /etc/mysql/my.cnf.


13

The accounts with passwords are the accounts with a glob of base64 gibberish in the second field: root:8sh9JBUR0VYeQ:0:0:Super-User,,,,,,,:/:/bin/ksh lp:VvHUV8idZH1uM:9:9:Print Spooler Owner:/var/spool/lp:/bin/sh This computer appears to be using the traditional, DES-based crypt(3) password hash. This hash is quite weak by modern standards; if you can't ...


12

It depends on what exactly was there before, but it might be easy(-ish) to recover from this. Use dd to create a full image of your USB drive on a safe location. Use dd to create a full image of your USB drive on a safe location. Yes, please do keep a full image. Data recovery operations can often cause more damage than one would expect. Try to remember ...


11

Many text editors keep backup files. If you are really lucky, there might be something like yourfile.tex~ including a previous version of your file.


11

First, never move a file across the network, only copy. You can always delete the original after the copy has been successfully completed. Secondly, your local system might not even be aware that a filesystem quota exists on remote storage - don't assume that it's even possible to guess ahead of time whether a copy operation would fail due to a remote quota. ...


11

Your overwritten files are lost forever from that partition. Restore them from backup. Running Testdisk from a live CD might help a little; use the Testdisk live CD, which has a number of recovery tools. But be aware that recovery quickly gets difficult; it'll be quicker to recover your own data from backups, and to reinstall any third-party software from ...


10

I think that the simplest answer is that dd, dd_rescue and ddrescue are not designed to defeat copy protection schemes. They make no assumptions about the format of the data and try to maintain the integrity of the whole of the original on disk data. In the case of dd I suspect that it is terminating due to an intentional read error on the disk that is part ...


10

Unfortunately, I was unable to recover the file system and had to resort to lower-level data recovery techniques (nicely summarised in Ubuntu's Data Recovery wiki entry), of which Sleuth Kit proved most useful. Marking as answered for cleanliness' sake.


10

As with all things pertaining to security, there aren't any guarantees, but you also need to balance risk (and cost) against probability. From experience (and I've been running dozens of *nix boxen since the dark ages), I've never really had significant power-caused filesystem corruption. Some of these machines were even running on non-journalled ...


10

With a bit of chances, sometimes I can recover deleted files with this script : #!/bin/bash if [[ ! $1 ]]; then echo -e "Usage:\n\n\t$0 'file name'" exit 1 fi f=$(ls 2>/dev/null -l /proc/*/fd/* | fgrep "$1 (deleted" | awk '{print $9}') if [[ $f ]]; then echo "fd $f found..." cp -v "$f" "$1" else echo >&2 "No fd found..." ...


9

I use SystemRescueCd. It boots to a bash shell (where you can startx if you want) and can mount ntfs drives using ntfs-3g. It also includes a lot of rescue tools.


9

What you should try is the following: Use file command on the archive to see if it's recognized as gzip-ped data. Run strace gunzip on the file. This will print the last bytes read from the file which might help you identify the point in file where corruption occurs. Run a debug build of gunzip under gdb. Try to correct the corrupted section (you have to ...


9

Using tail in follow mode should allow you to do what you want. tail -n +0 -f /proc/<pid>/fd/<fd> > abc.deleted I just did a quick test and it seems to work here. You did not mention whether your file was a binary file or not. My main concern is that it may not copy from the start of file but the -n +0 argument should do that even for ...


9

If a file has been deleted but is still open, that means the file still exists in the filesystem (it has an inode) but has a hard link count of 0. Since there is no link to the file, you cannot open it by name. There is no facility to open a file by inode either. There is no way to discover the file through its filesystem, and especially no way to look for ...



Only top voted, non community-wiki answers of a minimum length are eligible