Re: fsck on ext3, lost files



Gary Parker wrote:

Lost+found contains over 300 entries numbered #1504387 through #4635638. About
50 of these are directories. One of these directories contains most of my
user's home directory, though many of the subdirectories that I am interested in
appear empty. In particular I am looking for jpeg images.

[...]

I've read, "Your only hope is to "grep" for parts of your files that have been
deleted and hope for the best." Is this still true?

Something like this happened to me once (but I do not remember why).
Lost+found contained various entries that did not make any sense at
first, but they actually appeared to be files I was looking for, only
with weird names, and _scattered_ all over the place.

What I mean, is that if files were in a certain directory, they can no
longer be in that one directory. You will probably need to check all of
them to find what you are looking for.

A valuable tool in this case is "file". It can identify loads of
different file formats, and can be very effective in conjunction with
some shell scripting. There is also tool called "testdisk". I have never
used it, but it does seem to have some very useful features.

It is highly unlikely that you will be able to recover a lot of useful
data by examining hard drive physically, but if that is important for
you, here are some tips:

* Only operate the disk in read-only mode.
* First of all try to locate you data in _files_ in lost+found. Most of
it should be should still be there. It is just a matter of copying the
files and renaming them properly.
* After you have salvaged your files, then you may want to do physical
analysis of the disk using "testdisk" or similar tools, if there are
still thing missing.

Of course, this is based on the assumption that you do have another disk
or a separate bootable partition available. Otherwise you will have to
move files around in the same partition and this will overwrite parts of
files that might have survived somewhere on disk.

In my case, I was able to locate all my important data in lost+found.
Chances are that you will also.

Good luck.


--
To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx
with a subject of "unsubscribe". Trouble? Contact listmaster@xxxxxxxxxxxxxxxx



Relevant Pages

  • Re: "superblock last write time is in the future" on boot
    ... It has to do with the fact that the local time ... trouble. ... > "One disk to rule them all, ... > with a subject of "unsubscribe". ...
    (Debian-User)
  • Re: Problem booting RAID1/mdadm system when one disk is unplugged
    ... My System has 2x120GB IDE disks with the an up-to-date Sarge install, running kernel 2.6.8-3 and configured for mirroring. ... some friends of mine do not agree that my initrd is the problem because they point out that I can still boot when two disks are present. ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx with a subject of "unsubscribe". ... disk BIOS presents, and partition number 6 on that disk. ...
    (Debian-User)
  • Re: Problem booting RAID1/mdadm system when one disk is unplugged
    ... My System has 2x120GB IDE disks with the an up-to-date Sarge install, running kernel 2.6.8-3 and configured for mirroring. ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx with a subject of "unsubscribe". ... first disk BIOS presents, and partition number 6 on that disk. ... You always want to RAID1 the swap as well. ...
    (Debian-User)
  • Upgrading Hard Drives
    ... The a command in fdisk says to toggle a boot flag. ... I looked at the known good disk and the new one ... OSU Information Technology Department Telecommunications Services Group ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx ...
    (Debian-User)
  • Re: Closing laptop without suspending
    ... can induce a lot of vibration into the electrical/mechanical components ... stopping the drive when the machine suspends, ... The disk will spin down very quickly. ... To UNSUBSCRIBE, email to debian-user-REQUEST@xxxxxxxxxxxxxxxx ...
    (Debian-User)