Mailinglist Archive: opensuse (3618 mails)

< Previous Next >
Re: [opensuse] Recover stupidly deleted files
  • From: Greg Freemyer <greg.freemyer@xxxxxxxxx>
  • Date: Tue, 27 Jan 2009 14:42:19 -0500
  • Message-id: <87f94c370901271142y6d569058u9bbd2bc05493907d@xxxxxxxxxxxxxx>
On Tue, Jan 27, 2009 at 2:33 PM, Regis Matejcik
<rm@xxxxxxxxxxxxxxxxxxxxxxxx> wrote:
I'm using Suse 11.0. (reiserfs file system) I stupidly deleted an
important directory and it's backup. I used "reiserfsck --rebuild-tree"
to try to recover the directory and files. It succeeded in recovering
many files and storing them in a "lost and found" file. Most of
the .pdf and .mp3 files were rebuilt in tact, but thousands of files are
simply unidentifiable binary files. I'm guessing they're mostly Open
Office documents since that was the majority of what was lost.

I also tried Reiserfs File Recovery 1.0 which proved to be of little

Any hints on anything that might either unscramble the files from
reiserfsck, or do a better job of recovering files?



The first thing you need to do is preserve a copy of the filesystem.
Then you can figure out how to recover from there.

You will need a drive with enough freespace to hold a full copy of the
problem filesystem.

Then do:

dd if=/dev/sdaN of=<image_file> conv=noerror,sync

Once you have the image_file, hopefully you can find a tool to recover
your files with.

If you happen to be in Europe you might be able to find someone that
has a copy of X-Ways Forensics. ($1200).

XWF can recover deleted files from ReiserFS. Not sure what free tools
can do that.

XWF is also used in the US, but it is no where near as popular as in
Europe. In particular, XWF is a German company.

Greg Freemyer
Litigation Triage Solutions Specialist
First 99 Days Litigation White Paper -

The Norcross Group
The Intersection of Evidence & Technology
To unsubscribe, e-mail: opensuse+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse+help@xxxxxxxxxxxx

< Previous Next >