Solved

undelete ext2

Posted on 2008-11-02
12
647 Views
Last Modified: 2013-11-14
how do i undelete a shared folder on an external Fantom Drive.  It has a Linux based OS.  I accidently deleted over 700MB of my data.  The drive is only GB Eth so I cannot attach directly to my Mac/PC
0
Comment
Question by:Azyre
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 2
  • 2
  • +1
12 Comments
 
LVL 4

Expert Comment

by:Kaddict
ID: 22861837
I'm sorry to inform you that it may be impossible to recover data deleted on a network disk, but we should still try to help you

In order to help u though, you need to post the Exact model and firmware version of your drive please post that information and we'll take a look

thanks,

-kaddict
0
 
LVL 4

Assisted Solution

by:tjilp
tjilp earned 100 total points
ID: 22861870
Hello,

I am afraid kaddict is right, your data is likely to be gone forever.

But if it's importand enough to warrant some extra effort you could try this tool, but do not get your hopes up.

This tool does require you got physical access to the drive that contains the data.
http://www.student.dtu.dk/~s042078/magicrescue/

Tjilp
0
 
LVL 4

Expert Comment

by:Kaddict
ID: 22861890
Yup another good tool will be GetDataBack NTFS (or FAT) but again you will need to blow up your network drive to get physical access to the disk, which is not a good idea to start with.
0
Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

 
LVL 4

Expert Comment

by:Kaddict
ID: 22861924
Ignore my previous post since you talk about a linux filesystem sorry
0
 
LVL 3

Author Comment

by:Azyre
ID: 22861950

It is the 1 TB model.  2 internal 500GB drives formatted in EXT2 @ 1TB.

Product Name                 Geforce NAS
Firmware Version               2.6.3a-n
Product Vendor               Fantom Drives
0
 
LVL 3

Author Comment

by:Azyre
ID: 22861966
Also, please note.  I am trying to access this drive from my MAC or WinXP machines.  I do NOT have a Linux box and am not that familar with Linux.  The Fantom Drive uses Linux for its Web UI.  Thx everyone!
0
 
LVL 4

Expert Comment

by:tjilp
ID: 22861991
As all the previous posts statet, it is not going to be likely that you can recover.
Your data being on a striped disk set in a nas doesn't make it easyer.

You will have to attach the drives to a pc that can run the above mentioned tools and hope that the data is stil recoverable.

A small tip for when this is over.
From what you tell me I conclude that you have 2 500Mb drives in a raid0 configuration, also known as a stripe set.
If you put 2 drives in a stripe set you get a lot of space but no redundancy, if in one drive in a stripe set fails, all your data will be gone.
You might want to consider putting them in a raid1(mirror) configuration for redundancy. This costs space but gives you the extra data security.
In a mirror your data is still there for you when one drive fails.
and a very importent side note : changing raid configuration destroys data, so backup first.
0
 
LVL 4

Expert Comment

by:Kaddict
ID: 22861992
BTW, wow what a drive :)  tought only LaCie made such damn great drives like that.

Also, a (sad) comment : If you used a mirror you'd only have 500gb total, but those 500gb would have been secured...

im' looking at something you could try to recover your data,

brb :)

-kaddict
0
 
LVL 4

Expert Comment

by:Kaddict
ID: 22861994
lol tjilp looks like we share an exactly same point of view on that situation :)
0
 
LVL 13

Accepted Solution

by:
Xyptilon2 earned 300 total points
ID: 22862006
Well, I have succesfully retrieved data from ext3 file systems (because i knew what was lost). And on ext2 the procedure is similar, though it is not really undeleting. It is grepping data from the block device, writing it to another partition and analyzing the block of data with a program to extract useful data from it.

You need two tools for it, Sleuthkit and Foremost, i was on Debian, so installed it with:

apt-get install sleuthkit foremost

Next comes the procedure:

1. Determine on which partition your lost files are with "df -h" (for example /dev/sda1).
2. Open "debugfs /dev/sda1" and go to the directory cd /targetdirectory (remember that the top most directory (the mount point) does not have to be specified.
3. ls -d (show deleted files) (files that are in angular brackets <>) and write down this Inode number
4. "imap <number>" Determine which group this Inode belongs to include the angular brackets in the command
5. "stats" Determine the blocksize (somewhere in the middle of all the output (usually 32768)

Next we are going to calculate the range that we want to retrieve, we do this with:

start = blockgroup * blocksize
end = ((blockgroup + 1) * blocksize) - 1

# Create command and save output to OTHER partition:
dls /dev/sda1 begin-end > /otherpartition/block.dat

Now we have a dump of that particular block, we can use a program called foremost to try to extract something useful out of it.

# Create an output directory
mkdir /otherpartition/output

# Run the command
foremost -dv -i /otherpartition/block.dat -o /otherpartition/output/

Now, have a look at /otherpartition/output/ and try your luck.

I hope this is useful to somebody.

0
 
LVL 4

Assisted Solution

by:Kaddict
Kaddict earned 100 total points
ID: 22862014
(note, as you most prolly know, do NOT write anymore on that drive until you recover/give up)
 
Sadly I confirm that from what I know, you will need EVERYTHING listed here :

- A desktop computer with a RAID0- and SATA2-NCQ- compatible adapter
- To get both hard disk physically out of their aluminium case (since you will prolly break the aluminium case, you need to know what you like the most, those 70gb, or the case, and only you can answer that question)
- You will also need tjilp's SW : http://www.student.dtu.dk/~s042078/magicrescue/
- Finally, you will need a bit of luck... :(

-kaddict
0
 
LVL 13

Expert Comment

by:Xyptilon2
ID: 22862037
I just read the post again and see you've not much experience with Linux and want to retrieve it from a Windows machine.

What I can imagine is that the procedure would be the same. First, get a RAW dump of the block device. On Windows, you can do this (for the whole drive) with WinHex for example (this has native ext2 and ext3 support). Please note that this software is not for the faint of heart. It edits directly into RAM or on the disk, make sure you know what you're doing. It can be found here: http://www.x-ways.net/winhex/

Via the menu Tools -> Open disk, you can open a drive or start recovery procedures, perhaps it is a good idea to clone the drive first to make sure you dont loose anything.

Goodluck!
0

Featured Post

Secure Your WordPress Site: 5 Essential Approaches

WordPress is the web's most popular CMS, but its dominance also makes it a target for attackers. Our eBook will show you how to:

Prevent costly exploits of core and plugin vulnerabilities
Repel automated attacks
Lock down your dashboard, secure your code, and protect your users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Fine Tune your automatic Updates for Ubuntu / Debian
The business world is becoming increasingly integrated with tech. It’s not just for a select few anymore — but what about if you have a small business? It may be easier than you think to integrate technology into your small business, and it’s likely…
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

695 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question