On Saturday 28 October 2006 11:03, Anders Johansson wrote:

ext3 is worse than ext2 in this respect. ext2 just marks a block as unused, but ext3 actively overwrites the pointer. This means undelete in ext2 is just a question of resetting the block to "used", but in ext3 you have to perform some detective work, finding your file data on the disk, and then traversing the linked list of blocks backwards and forwards until you find the beginning and end, and then marking each block as used, and creating a pointer to the start in an inode

Needless to say, this isn't trivial, and relies on finding the file data in the first place. With binary files, this can be difficult

You might be able to get results using The sleuth kit. I've never tried it myself, so I couldn't say much about it, but other undelete tools recommend it

http://www.sleuthkit.org/sleuthkit/

Cheers, to be honest if I can't restore the directory structure the files will be useless as they won't mean anything unless I know where they belong. The machine was a webserver, had 900 websites on it. Matthew

On Saturday 28 October 2006 12:09, Matthew Stringer wrote:

Cheers, to be honest if I can't restore the directory structure the files will be useless as they won't mean anything unless I know where they belong.

AFAIK, if the guy did an rm -fr on your root dir then your filesystem is outright hosed. The only reasonable chance of a recovery would be to send it to data recovery specialists. This will cost an arm and two legs, however, and still might not work. You chances from recovering from an 'fdisk' screw up are higher - i've actually fully recovered partitions after accidentally deleting them. The reason that undelete under Windows is so easy is because of the way a delete works: the block which holds the data is simply marked as freed, but the data isn't nuked. On old DOS systems, a delete simply removed the FIRST LETTER of the filename, and this effectively removed the file from view. An undelete required that you specify a first letter for the file (it needn't be the original first letter, but the file needed *some* first letter). On journaled filesystems, like rieser and ext3, and undelete becomes technically much more difficult to do, for reasons beyond my full comprehension.

The machine was a webserver, had 900 websites on it.

If there were no backups, then the organization he worked for is just as guilty as he is for the lost data. To second Anders' note about suing the guy: i would honestly contact the police and see if you can pursue that as a cyber crime. i wouldn't be surprised if the intentional destruction of a company's electronic assets can be presecuted as a felony crime (perhaps even "terrorism", considering the "flexible" definition of that word). AFAIK, cyber-crime automatically falls into the realm of the FBI, and not local authorities (an employee stole some proprietary info from my mom's company computers when he left, and she was directed to the FBI... who in turn refused to even look at the evidence (videos) which she brought them). The guy needs to have his balls removed unless, of course, the 900 sites he deleted were kiddy porn or some such, in which case he did the right thing ;). -- ----- stephan@s11n.net http://s11n.net "...pleasure is a grace and is not obedient to the commands of the will." -- Alan W. Watts

On Saturday 28 October 2006 21:48, stephan beal wrote:

On Saturday 28 October 2006 12:09, Matthew Stringer wrote:

If there were no backups, then the organization he worked for is just as guilty as he is for the lost data.

To second Anders' note about suing the guy: i would honestly contact the police and see if you can pursue that as a cyber crime. i wouldn't be surprised if the intentional destruction of a company's electronic assets can be presecuted as a felony crime (perhaps even "terrorism", considering the "flexible" definition of that word). AFAIK, cyber-crime automatically falls into the realm of the FBI, and not local authorities (an employee stole some proprietary info from my mom's company computers when he left, and she was directed to the FBI... who in turn refused to even look at the evidence (videos) which she brought them).

The guy needs to have his balls removed unless, of course, the 900 sites he deleted were kiddy porn or some such, in which case he did the right thing ;).

the guy had been laid off, decided to trash the machine and the backup to get back at his employer.

On Saturday 28 October 2006 12:58, Matthew Stringer wrote:

the guy had been laid off, decided to trash the machine and the backup to get back at his employer.

Never let a laid off (or worse, fired) employee touch a computer. Pay him the severance pay, and escort him out of the building. Then shutdown all ssh daemons untill you have time to change all passwords, AND REMOVE all ssh authorized_keys files he might have had access to. (lots of people forget that last bit and think that changing the password is sufficient...) -- _____________________________________ John Andersen

Can't find anything Linux wise that'll attempt a recovery. Going to try a Windows App. Odd that to recover a Linux machine I need to use M$ which can't read linux partitions! We live in an odd world! Matthew

On Saturday 28 October 2006 10:56, Matthew Stringer wrote:

Can't find anything Linux wise that'll attempt a recovery.

Going to try a Windows App.

Odd that to recover a Linux machine I need to use M$ which can't read linux partitions!

We live in an odd world!

Matthew

This will lead to tears. MS knows nothing about structures of ext2/ext3. -- _____________________________________ John Andersen

At 07:56 PM 10/28/2006 +0100, Matthew Stringer wrote:

Content-Disposition: inline

Can't find anything Linux wise that'll attempt a recovery.

Going to try a Windows App.

Odd that to recover a Linux machine I need to use M$ which can't read linux partitions!

We live in an odd world!

Matthew

If you succeed, a small faq on how you did it would undoubtedly be appreciated by all. Even if it does use a Windows routine. (Please specify the s/w, and the price.) --doug

On Sunday 29 October 2006 10:49, Catimimi wrote:

Matthew Stringer a écrit :

...

Hi

I've an old server with a single SCSI disk which a disgruntled techie has rm -Rf * from the root of the drive.

The backup has been trashed too.

Is there any way to restore not only the files but the directory tree?

Googling I read that doing this on the ext3 FS is impossible yet I've seen various Windows based pieces of software that claim to be able to restore no idea why they run on Windows and not Linux though?!

What's the chances of a resoration and is there something that I can run under Linux that will do it?

Cheers

Matthew

Hello,

Have a look there :

http://www.stellarinfo.com/disk-recovery.htm#linux

it could work for you.

Michel.

Hello, I have some good experiance from IBAS (http://www.ibas.com). Expensive but wery competent. Anders