[linux] (no subject)

Pátek Únor 21 03:23:07 CET 2003

On Tue, Feb 18, 2003 at 11:20:23AM +0100, Adami Jaromil wrote:
> Ahoj;
>  
> Nepoznate nejaky nastroj na obnovu vymazanych suborov v linuxe?

Zda sa mi ze to nebude vobec jednoduche! Ale predsa je niekolko tipov ako na
to. Tu su dva HOWTO navody ako na to a nizsie aj dva tipy (otazne je nakolko
ti budu osozne). Tie HOWTO som si stiahol z http://www.linuxdoc.org.

                              System Administration and Configuration (p4 of5) 
4.2.5. Recovery                                                                 

     * Ext2fs-Undeletion, Linux Ext2fs Undeletion mini-HOWTO                    

       Updated: February 1999. Presents a discussion of how to retrieve         
       deleted files from a Second Extended File System.                        

     * Ext2fs-Undeletion-Dir-Struct, Ext2fs Undeletion of Directory             
       Structures                                                               

       Updated: November 2000. Describes a straight forward way of recovering   
       whole directory structures, instead of file by file, that have been      
       removed by a misplaced rm -rf                                            

----------------------------

                                  The Linux Tips HOWTO: Detailed Tips (p2 of9) 

3.2 Desperate Undelete. Michael Hamilton, michael na actrix.gen.nz                 

   Here's a trick I've had to use a few times.                                  

   Desperate person's text file undelete.                                       

   If you accidentally remove a text file, for example, some email, or the      
   results of a late night programming session, all may not be lost. If the     
   file ever made it to disk, ie it was around for more than 30 seconds, its    
   contents may still be in the disk partition.                                 

   You can use the grep command to search the raw disk partition for the        
   contents of file.                                                            

   For example, recently, I accidentally deleted a piece of email. So I         
   immediately ceased any activity that could modify that partition: in this    
   case I just refrained from saving any files or doing any compiles etc. On    
   other occasions, I've actually gone to the trouble of bring the system       
   down to single user mode, and unmounted the filesystem.                      

   I then used the egrep command on the disk partition: in my case the email    
   message was in /usr/local/home/michael/, so from the output from df, I       
   could see this was in /dev/hdb5                                              

   sputnik3:~ % df                                                              
     Filesystem         1024-blocks  Used Available Capacity Mounted on         
     /dev/hda3              18621    9759     7901     55%   /                  
     /dev/hdb3             308852  258443    34458     88%   /usr               
     /dev/hdb5             466896  407062    35720     92%   /usr/local         

     sputnik3:~ % su                                                            
     Password:                                                                  
     [michael na sputnik3 michael]# egrep -50 'ftp.+COL' /dev/hdb5 > /tmp/x        

   Now I'm ultra careful when fooling around with disk partitions, so I         
   paused to make sure I understood the command syntax BEFORE pressing          
   return. In this case the email contained the word 'ftp' followed by some     
   text followed by the word 'COL'. The message was about 20 lines long, so I   
   used -50 to get all the lines around the phrase. In the past I've used       
   -3000 to make sure I got all the lines of some source code. I directed the   
   output from the egrep to a different disk partition - this prevented it      
   from over writing the message I was looking for.                             

   I then used strings to help me inspect the output                            

    strings /tmp/x | less                                                       

   Sure enough the email was in there.                                          

   This method can't be relied on, all, or some, of the disk space may have     
   already been re-used.                                                        

   This trick is probably only useful on single user systems. On multi-users    
   systems with high disk activity, the space you free'ed up may have already   
   been reused. And most of use can't just rip the box out from under our       
   users when ever we need to recover a file.                                   

   On my home system this trick has come in handy on about three occasions in   
   the past few years - usually when I accidentally trash some of the days      
   work. If what I'm working survives to a point where I feel I made            
   significant progress, it get's backed up onto floppy, so I haven't needed    
   this trick very often.                                                       

--------------------------------

Linux Frequently Asked Questions with Answers: Linux's handling of fi (p2 of5) 

4.2 How can I undelete files?                                                   

   In general, this is very hard to do on Unices because of their               
   multitasking nature. Undelete functionality for the ext2fs file system is    
   being worked on, but don't hold your breath.                                 

   There are a number of packages available which instead provide new           
   commands for deleting and copying which move deleted files into a            
   astebasket' directory. The files can be recovered until cleaned out        
   automatically by background processing.                                      

   Alternatively, you can search the raw disk device which holds the file       
   system in question. This is hard work, and you will need to be logged in     
   as root to do this.                                                          

------------------------------------