asked on

Recovering Deleted Data on Ubuntu Linux Server

Hi folks!

Got an Ubuntu Linux 12.04.3 LTS server that is acting as a network file server using Samba.

While connected from a Windows machine using a mapped network drive, I accidentally deleted a bunch of files that shouldn't have been. Too many for me to know the exact file names.

Assuming there is not an easy solution, like going to a backup, what is the best way to go about trying to recover or "undelete" these files? I'm a bit of a novice when it comes to Linux file systems.

Thanks,
Ithizar

ThomasMcA2

Testdisk can undelete files in Linux. See here for step-by-step instructions.

Ithizar

ASKER

Would you install TestDisk on the server where the deleted files are? That's what the instructions seem to apply, but I always understood you should not do any disk writes on a drive you're trying to recover data from.

ThomasMcA2

No, I would not install it on the same system - I'd run it from a LiveCD or LiveUSB.

Ithizar

ASKER

This is a machine sitting in a data center about an hour away from me, so I'd like to avoid physically going there if I could. :-) Do you know of a way to install and run TestDisk from another partition/location other than a LiveCD? Or, alternatively, do you know of any other product or technique that could be accomplished without physically accessing the server?

Thanks again!

ThomasMcA2

Can you mount the remote drive across the network? Testdisk can work on mounted drives, so you could just install it locally to fix the remote drive.

Ithizar

ASKER

Yes, I can. In fact, the machine I'm trying TestDisk from already has this particular share mounted. However, when I run TestDisk, I see nothing in the list of available disks that matches that mount point.

For example, if I run the "mount" command with no parameters, one of the entries I see is this:

//datastore02/mainwwwroot on /network/datastore02/mainwwwroot type cifs (rw,mand)

That is the network share in question. However, when I run TestDisk, I see this:

Select a media (use Arrow keys, then press Enter):
>Disk /dev/sda - 644 GB / 600 GiB - VMware Virtual disk
Disk /dev/mapper/easynas01-root - 642 GB / 598 GiB - VMware Virtual disk
Disk /dev/mapper/easynas01-swap_1 - 1073 MB / 1024 MiB - VMware Virtual disk
Disk /dev/sr0 - 64 MB / 61 MiB (RO) - VMware Virtual IDE CDROM Drive
Disk /dev/dm-0 - 642 GB / 598 GiB - VMware Virtual disk
Disk /dev/dm-1 - 1073 MB / 1024 MiB - VMware Virtual disk

(The machine I'm running from is a virtual machine, hence all the VMware Virtual disks.)

From there, how do I get it to look at a mounted drive and do recovery on it?

Thanks.

ASKER CERTIFIED SOLUTION

ThomasMcA2

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial