[plug] recovering deleted files

[Mike Hasleby]

Thanks to all who have replied.  The url Denis sent was helpful and I'd 
found another at 
http://www.securityhorizon.com/whitepapers/archives/undelete.html (via 
google)
Having read the suggestions and how to's I've talked about it with the 
"deleter"  He is heading to the cricket nets to take out some of his 
frustration then sitting down to redo the lot.
thanks again
Mike

ryan at is.as.geeky.as wrote:

>On Fri, 2002-12-13 at 14:54, Mike Hasleby wrote:
>
>>One of our staff members has accidently deleted a file he has been
>>working on all day (using Excel) that is stored on our staff file server
>>on an ext2 filesystem
>>Is it possible to undelete this.  I remember reading some emails on
>>something similar on plug about 2 years ago
>>TIA
>>
>
>I have used 'recover' to get files back with success (but don't get your
>hopes up).
>
>This util takes some of the length guess work of our grepping your
>filesystem by filtering things in a human readable form.
>
>apt-cache show recover says this:
>
>Description: Undelete files on ext2 partitions
> Recover automates some steps as described in the ext2-undeletion
> howto. This means it seeks all the deleted inodes on your hard drive
> with debugfs. When all the inodes are indexed, recover asks you some
> questions about the deleted file. These questions are:
>   * Hard disk device name
>   * Year of deletion
>   * Month of deletion
>   * Weekday of deletion
>   * First/Last possible day of month
>   * Min/Max possible file size
>   * Min/Max possible deletion hour
>   * Min/Max possible deletion minute
>   * User ID of the deleted file
>   * A text string the file included (can be ignored)
> .
> If recover found any fitting inodes, it asks to give a directory name
> and dumps the inodes into the directory. Finally it asks you if you
> want to filter the inodes again (in case you typed some wrong
> answers).
>
>Ryan
>
>

-- 
Mike Hasleby
Computer Technician
Lake Joondalup Baptist College		
8 Kennedya Drive  JOONDALUP  WA  6027
Phone: (618) 9400 2301  Fax: (618) 9300 1878
Postal Address:  PO Box 95 JOONDALUP  WA  6919
Email: hasm at ljbc.wa.edu.au
Web address: http://www.ljbc.wa.edu.au 

========================================================
The contents of this email are confidential and intended only for the named 
recipients of this e-mail.  If you have received this e-mail in error, you 
are hereby notified that any use, reproduction, disclosure or distribution 
or the information contained in this e-mail is prohibited.  Please notify 
the sender immediately and then delete/destroy the e-mail and any printed 
copies. All liability for viruses is excluded to the fullest extent of the 
law.