1

EDIT: I am using Debian 8.1.0

So I somehow deleted my /etc directory. While I have not been able to recover the complete /etc directory hierarchy with all files, I have received different parts from different recovery programs and was wondering whether there was any way to "combine" their efforts...

I used three programs from systemrescueCD linux:

  • testdisk lists the file system contents, with the etc directory and it's immediate sub directories colored red for deleted. (I can't access any of the directories within /etc/ except for /etc/avahi/services). I can copy their contents to a drive, however all the files and directories (except for the exception above avahi/services) are empty. Verified using the tree command. It seems unlikely new data overwriting the space used by /etc/ would cleanly cut off the directories like that, so why is testdisk unable to find and connect further subdirectories?
  • photorec recovers a huge number of raw files without their original names and separated into recup_dir.# directories, where # is a number from 1-52. I have managed to find a few files amongst these which are in /etc, such as wpa_supplicant.conf which contains its original content. So why does the /etc/wpa_supplicant.conf (with it's proper name and directory) recovered by testdisk not contain anything, while photorec can recover the contents of it but not connected to name or directory? What's the missing link?
  • Finally I messed around with extundelete. It seems to only be able to see the deleted files and directories directly under /etc too, listing their Inode number. Would this be in anyway helpful to restoring the "connection" between say wpa_supplicant.conf and it's contents? Why? extundelete was also able to recovery a handful of files, some of which where several directories deep, such as if-pre-down/script.sh from /etc/network/ and some files from /etc/init.d/.

Apart from the inevitable data loss from stuff being overwritten (I don't think this would be much since I didn't use it long after the deletion), would it be possible to get access to further subdirectories and file contents and link them all back together properly? I'm hoping there might be a way in combining various things from above and more. Either way, an explanation of why some things have been recoverable and others not, and how inodes, file allocation tables, etc., come into this would be appreciated. Thanks!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.