Solved

undelete ext2

Posted on 2008-11-02
12
644 Views
Last Modified: 2013-11-14
how do i undelete a shared folder on an external Fantom Drive.  It has a Linux based OS.  I accidently deleted over 700MB of my data.  The drive is only GB Eth so I cannot attach directly to my Mac/PC
0
Comment
Question by:Azyre
  • 6
  • 2
  • 2
  • +1
12 Comments
 
LVL 4

Expert Comment

by:Kaddict
ID: 22861837
I'm sorry to inform you that it may be impossible to recover data deleted on a network disk, but we should still try to help you

In order to help u though, you need to post the Exact model and firmware version of your drive please post that information and we'll take a look

thanks,

-kaddict
0
 
LVL 4

Assisted Solution

by:tjilp
tjilp earned 100 total points
ID: 22861870
Hello,

I am afraid kaddict is right, your data is likely to be gone forever.

But if it's importand enough to warrant some extra effort you could try this tool, but do not get your hopes up.

This tool does require you got physical access to the drive that contains the data.
http://www.student.dtu.dk/~s042078/magicrescue/

Tjilp
0
 
LVL 4

Expert Comment

by:Kaddict
ID: 22861890
Yup another good tool will be GetDataBack NTFS (or FAT) but again you will need to blow up your network drive to get physical access to the disk, which is not a good idea to start with.
0
Master Your Team's Linux and Cloud Stack!

The average business loses $13.5M per year to ineffective training (per 1,000 employees). Keep ahead of the competition and combine in-person quality with online cost and flexibility by training with Linux Academy.

 
LVL 4

Expert Comment

by:Kaddict
ID: 22861924
Ignore my previous post since you talk about a linux filesystem sorry
0
 
LVL 3

Author Comment

by:Azyre
ID: 22861950

It is the 1 TB model.  2 internal 500GB drives formatted in EXT2 @ 1TB.

Product Name                 Geforce NAS
Firmware Version               2.6.3a-n
Product Vendor               Fantom Drives
0
 
LVL 3

Author Comment

by:Azyre
ID: 22861966
Also, please note.  I am trying to access this drive from my MAC or WinXP machines.  I do NOT have a Linux box and am not that familar with Linux.  The Fantom Drive uses Linux for its Web UI.  Thx everyone!
0
 
LVL 4

Expert Comment

by:tjilp
ID: 22861991
As all the previous posts statet, it is not going to be likely that you can recover.
Your data being on a striped disk set in a nas doesn't make it easyer.

You will have to attach the drives to a pc that can run the above mentioned tools and hope that the data is stil recoverable.

A small tip for when this is over.
From what you tell me I conclude that you have 2 500Mb drives in a raid0 configuration, also known as a stripe set.
If you put 2 drives in a stripe set you get a lot of space but no redundancy, if in one drive in a stripe set fails, all your data will be gone.
You might want to consider putting them in a raid1(mirror) configuration for redundancy. This costs space but gives you the extra data security.
In a mirror your data is still there for you when one drive fails.
and a very importent side note : changing raid configuration destroys data, so backup first.
0
 
LVL 4

Expert Comment

by:Kaddict
ID: 22861992
BTW, wow what a drive :)  tought only LaCie made such damn great drives like that.

Also, a (sad) comment : If you used a mirror you'd only have 500gb total, but those 500gb would have been secured...

im' looking at something you could try to recover your data,

brb :)

-kaddict
0
 
LVL 4

Expert Comment

by:Kaddict
ID: 22861994
lol tjilp looks like we share an exactly same point of view on that situation :)
0
 
LVL 13

Accepted Solution

by:
Xyptilon2 earned 300 total points
ID: 22862006
Well, I have succesfully retrieved data from ext3 file systems (because i knew what was lost). And on ext2 the procedure is similar, though it is not really undeleting. It is grepping data from the block device, writing it to another partition and analyzing the block of data with a program to extract useful data from it.

You need two tools for it, Sleuthkit and Foremost, i was on Debian, so installed it with:

apt-get install sleuthkit foremost

Next comes the procedure:

1. Determine on which partition your lost files are with "df -h" (for example /dev/sda1).
2. Open "debugfs /dev/sda1" and go to the directory cd /targetdirectory (remember that the top most directory (the mount point) does not have to be specified.
3. ls -d (show deleted files) (files that are in angular brackets <>) and write down this Inode number
4. "imap <number>" Determine which group this Inode belongs to include the angular brackets in the command
5. "stats" Determine the blocksize (somewhere in the middle of all the output (usually 32768)

Next we are going to calculate the range that we want to retrieve, we do this with:

start = blockgroup * blocksize
end = ((blockgroup + 1) * blocksize) - 1

# Create command and save output to OTHER partition:
dls /dev/sda1 begin-end > /otherpartition/block.dat

Now we have a dump of that particular block, we can use a program called foremost to try to extract something useful out of it.

# Create an output directory
mkdir /otherpartition/output

# Run the command
foremost -dv -i /otherpartition/block.dat -o /otherpartition/output/

Now, have a look at /otherpartition/output/ and try your luck.

I hope this is useful to somebody.

0
 
LVL 4

Assisted Solution

by:Kaddict
Kaddict earned 100 total points
ID: 22862014
(note, as you most prolly know, do NOT write anymore on that drive until you recover/give up)
 
Sadly I confirm that from what I know, you will need EVERYTHING listed here :

- A desktop computer with a RAID0- and SATA2-NCQ- compatible adapter
- To get both hard disk physically out of their aluminium case (since you will prolly break the aluminium case, you need to know what you like the most, those 70gb, or the case, and only you can answer that question)
- You will also need tjilp's SW : http://www.student.dtu.dk/~s042078/magicrescue/
- Finally, you will need a bit of luck... :(

-kaddict
0
 
LVL 13

Expert Comment

by:Xyptilon2
ID: 22862037
I just read the post again and see you've not much experience with Linux and want to retrieve it from a Windows machine.

What I can imagine is that the procedure would be the same. First, get a RAW dump of the block device. On Windows, you can do this (for the whole drive) with WinHex for example (this has native ext2 and ext3 support). Please note that this software is not for the faint of heart. It edits directly into RAM or on the disk, make sure you know what you're doing. It can be found here: http://www.x-ways.net/winhex/

Via the menu Tools -> Open disk, you can open a drive or start recovery procedures, perhaps it is a good idea to clone the drive first to make sure you dont loose anything.

Goodluck!
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Intel fortran compiler (ifort) 5 38
Backup application that will backup to google cloud 12 74
The better OS Architecture 13 68
Redhat upgrade 1 27
Create your own, high-performance VM backup appliance by installing NAKIVO Backup & Replication directly onto a Synology NAS!
Is your phone running out of space to hold pictures?  This article will show you quick tips on how to solve this problem.
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…
This Micro Tutorial will teach you how to reformat your flash drive. Sometimes your flash drive may have issues carrying files so this will completely restore it to manufacturing settings. Make sure to backup all files before reformatting. This w…

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question