-2

I have accidentally deleted some important files of ldap server. Now I am trying to recover all these files. I tried this post and ran these commands:

# mount
/dev/mapper/VolGroup00-LogVol00 on / type ext4 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
tmpfs on /dev/shm type tmpfs (rw)
/dev/sda1 on /boot type ext4 (rw)
/dev/mapper/VolGroup00-LogVol02 on /home type ext4 (rw)
/dev/mapper/VolGroup00-LogVol01 on /opt type ext4 (rw)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)
gvfs-fuse-daemon on /root/.gvfs type fuse.gvfs-fuse-daemon (rw,nosuid,nodev)
# pwd
/etc/openldap/slapd.d
# debugfs -w /dev/mapper/VolGroup00-LogVol01
debugfs 1.41.12 (17-May-2010)
debugfs:  lsdel
 Inode  Owner  Mode    Size      Blocks   Time deleted
0 deleted inodes found.
debugfs:  #
#  debugfs -w /dev/mapper/VolGroup00-LogVol00
debugfs 1.41.12 (17-May-2010)
debugfs:  lsdel
 Inode  Owner  Mode    Size      Blocks   Time deleted
0 deleted inodes found.

But every time I got 0 deleted node found. Can anyone tell me under what file system /etc comes or how to go to this directory /etc/openldap/slapd.d so that I can recover the files?

  • 2
    Just restore from backup (or fire your sysadmin as incompetent if he hasn't made backups). – Anthon Jul 14 '15 at 7:30
3

Using the df utility you should be able to see on what filesystem a directory is seated, for example:

df -h /etc
Filesystem                   Size  Used Avail Use% Mounted on
/dev/mapper/crypt--lvm-root  225G  165G   50G  77% /

Note the input as /etc and the listed output / in column "Mounted on"

  • again getting 0 deleted node found so its not possible to recover deleted file now? – LinuxBegineer Jul 14 '15 at 7:32
  • 1
    If your host is not rebooted yet, you might have the chance that the file is still opened by another process. Try lsof|egrep "COMMAND|deleted" to list those files. If your file is listed you can copy it from the open file descriptor of the process holding the handle using: cp /proc/<PID>/fd/<FD> where PID and FD are the values from the corresponding columns in the lsof output – Lambert Jul 14 '15 at 7:56
  • @Lamert the above command even not showing file deleted from openldap its showing other deleted file – LinuxBegineer Jul 14 '15 at 7:59
  • Have you tried extundelete? Please read the page edunham.net/2015/03/02/the_magic_of_extundelete.html for a use case. – Lambert Jul 14 '15 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.