Solved

undelete ext2

Posted on 2008-11-02
12
640 Views
Last Modified: 2013-11-14
how do i undelete a shared folder on an external Fantom Drive.  It has a Linux based OS.  I accidently deleted over 700MB of my data.  The drive is only GB Eth so I cannot attach directly to my Mac/PC
0
Comment
Question by:Azyre
  • 6
  • 2
  • 2
  • +1
12 Comments
 
LVL 4

Expert Comment

by:Kaddict
Comment Utility
I'm sorry to inform you that it may be impossible to recover data deleted on a network disk, but we should still try to help you

In order to help u though, you need to post the Exact model and firmware version of your drive please post that information and we'll take a look

thanks,

-kaddict
0
 
LVL 4

Assisted Solution

by:tjilp
tjilp earned 100 total points
Comment Utility
Hello,

I am afraid kaddict is right, your data is likely to be gone forever.

But if it's importand enough to warrant some extra effort you could try this tool, but do not get your hopes up.

This tool does require you got physical access to the drive that contains the data.
http://www.student.dtu.dk/~s042078/magicrescue/

Tjilp
0
 
LVL 4

Expert Comment

by:Kaddict
Comment Utility
Yup another good tool will be GetDataBack NTFS (or FAT) but again you will need to blow up your network drive to get physical access to the disk, which is not a good idea to start with.
0
 
LVL 4

Expert Comment

by:Kaddict
Comment Utility
Ignore my previous post since you talk about a linux filesystem sorry
0
 
LVL 3

Author Comment

by:Azyre
Comment Utility

It is the 1 TB model.  2 internal 500GB drives formatted in EXT2 @ 1TB.

Product Name                 Geforce NAS
Firmware Version               2.6.3a-n
Product Vendor               Fantom Drives
0
 
LVL 3

Author Comment

by:Azyre
Comment Utility
Also, please note.  I am trying to access this drive from my MAC or WinXP machines.  I do NOT have a Linux box and am not that familar with Linux.  The Fantom Drive uses Linux for its Web UI.  Thx everyone!
0
Get up to 2TB FREE CLOUD per backup license!

An exclusive Black Friday offer just for Expert Exchange audience! Buy any of our top-rated backup solutions & get up to 2TB free cloud per system! Perform local & cloud backup in the same step, and restore instantly—anytime, anywhere. Grab this deal now before it disappears!

 
LVL 4

Expert Comment

by:tjilp
Comment Utility
As all the previous posts statet, it is not going to be likely that you can recover.
Your data being on a striped disk set in a nas doesn't make it easyer.

You will have to attach the drives to a pc that can run the above mentioned tools and hope that the data is stil recoverable.

A small tip for when this is over.
From what you tell me I conclude that you have 2 500Mb drives in a raid0 configuration, also known as a stripe set.
If you put 2 drives in a stripe set you get a lot of space but no redundancy, if in one drive in a stripe set fails, all your data will be gone.
You might want to consider putting them in a raid1(mirror) configuration for redundancy. This costs space but gives you the extra data security.
In a mirror your data is still there for you when one drive fails.
and a very importent side note : changing raid configuration destroys data, so backup first.
0
 
LVL 4

Expert Comment

by:Kaddict
Comment Utility
BTW, wow what a drive :)  tought only LaCie made such damn great drives like that.

Also, a (sad) comment : If you used a mirror you'd only have 500gb total, but those 500gb would have been secured...

im' looking at something you could try to recover your data,

brb :)

-kaddict
0
 
LVL 4

Expert Comment

by:Kaddict
Comment Utility
lol tjilp looks like we share an exactly same point of view on that situation :)
0
 
LVL 13

Accepted Solution

by:
Xyptilon2 earned 300 total points
Comment Utility
Well, I have succesfully retrieved data from ext3 file systems (because i knew what was lost). And on ext2 the procedure is similar, though it is not really undeleting. It is grepping data from the block device, writing it to another partition and analyzing the block of data with a program to extract useful data from it.

You need two tools for it, Sleuthkit and Foremost, i was on Debian, so installed it with:

apt-get install sleuthkit foremost

Next comes the procedure:

1. Determine on which partition your lost files are with "df -h" (for example /dev/sda1).
2. Open "debugfs /dev/sda1" and go to the directory cd /targetdirectory (remember that the top most directory (the mount point) does not have to be specified.
3. ls -d (show deleted files) (files that are in angular brackets <>) and write down this Inode number
4. "imap <number>" Determine which group this Inode belongs to include the angular brackets in the command
5. "stats" Determine the blocksize (somewhere in the middle of all the output (usually 32768)

Next we are going to calculate the range that we want to retrieve, we do this with:

start = blockgroup * blocksize
end = ((blockgroup + 1) * blocksize) - 1

# Create command and save output to OTHER partition:
dls /dev/sda1 begin-end > /otherpartition/block.dat

Now we have a dump of that particular block, we can use a program called foremost to try to extract something useful out of it.

# Create an output directory
mkdir /otherpartition/output

# Run the command
foremost -dv -i /otherpartition/block.dat -o /otherpartition/output/

Now, have a look at /otherpartition/output/ and try your luck.

I hope this is useful to somebody.

0
 
LVL 4

Assisted Solution

by:Kaddict
Kaddict earned 100 total points
Comment Utility
(note, as you most prolly know, do NOT write anymore on that drive until you recover/give up)
 
Sadly I confirm that from what I know, you will need EVERYTHING listed here :

- A desktop computer with a RAID0- and SATA2-NCQ- compatible adapter
- To get both hard disk physically out of their aluminium case (since you will prolly break the aluminium case, you need to know what you like the most, those 70gb, or the case, and only you can answer that question)
- You will also need tjilp's SW : http://www.student.dtu.dk/~s042078/magicrescue/
- Finally, you will need a bit of luck... :(

-kaddict
0
 
LVL 13

Expert Comment

by:Xyptilon2
Comment Utility
I just read the post again and see you've not much experience with Linux and want to retrieve it from a Windows machine.

What I can imagine is that the procedure would be the same. First, get a RAW dump of the block device. On Windows, you can do this (for the whole drive) with WinHex for example (this has native ext2 and ext3 support). Please note that this software is not for the faint of heart. It edits directly into RAM or on the disk, make sure you know what you're doing. It can be found here: http://www.x-ways.net/winhex/

Via the menu Tools -> Open disk, you can open a drive or start recovery procedures, perhaps it is a good idea to clone the drive first to make sure you dont loose anything.

Goodluck!
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

I. Introduction There's an interesting discussion going on now in an Experts Exchange Group — Attachments with no extension (http://www.experts-exchange.com/discussions/210281/Attachments-with-no-extension.html). This reminded me of questions tha…
How to update Firmware and Bios in Dell Equalogic PS6000 Arrays and Hard Disks firmware update.
This video teaches viewers how to encrypt an external drive that requires a password to read and edit the drive. All tasks are done in Disk Utility. Plug in the external drive you wish to encrypt: Make sure all previous data on the drive has been …
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now