[plug] deleted/missing files

[Lucas van Staden]

Hi,

 From experience, if you do intend to do some kind of undelete, you MUST 
stop all activity on the drive in question.
Your chances to undelete/recover files from the system decreases as you 
use the drive, as the nodes containing your info get over written

Added to that (again from past experience), to undelete from an ext2 
partition is a simpler job, and from ext3 is much less likely.

It is due to the above, that I only use ext2 for certain hd's now where 
I store critical data, and ext3 for the root system

-Lucas

Jon L. Miller wrote:
> There was a backup however the backup folder is also empty which I cannot
> explain, because it was using a USB connected device to a mapped drive off
> a windows xp desktop.  The program was doing the backup with any problems.
>  Yet the day the server came to me the folder in question was empty on
> both the server and the backup unit.
> So no one really can explain where the data went.  What i'm hoping is to
> restore or find the data on the server at this point.
> The users were connecting to the linux server via a mapped drive through
> samba and shared folder access.  This particular folder was restricted to
> 2 users.  No others could access it, this was tested.
>
> Jon
>
> On Wed, January 28, 2009 17:28, Daniel Pittman wrote:
>   
>> "Jon L. Miller" <jlmiller at mmtnetworks.com.au> writes:
>>
>>     
>>> Got a server Debian Sarge that had some file (quite a large amount)
>>> that has suddenly disappeared.  The users swear they did not delete
>>> it.
>>>       
>> >From long and painful experience, they are probably technically wrong,
>> but it also may not be their fault: I have had a number of occasions
>> when directories were inadvertently moved, deleted or lost because of
>> user accident[2] or Windows "offline files" deleting things, or...
>>
>>     
>>> Is there a way to search the unit for these missing files and is there
>>> a way to see what has been deleted?
>>>       
>> There are plenty of ways to look for the files, if you know what they
>> are, such as find(1), locate(1), or just looking.
>>
>> As to "seeing what has been deleted", probably not, but you would need
>> to better define how users access the files before we can answer.
>>
>>     
>>> The server has been turned off and moved from up the hill to West
>>> Perth, would this have any effect on the files?
>>>       
>> It certainly could: did it fsck clean before and after the move?
>>
>> It isn't unknown for rebooting to show up a corrupt filesystem, or even
>> for moving the hardware to provoke a failure through rough handling or
>> plain bad luck, so it /could/ be related.
>>
>>
>> Personally, I would just dig the files out of backups.  It saves time
>> and trouble.
>>
>> Regards,
>>         Daniel
>>
>> ...except I bet they don't have current backups, eh?
>>
>> Footnotes:
>> [2]  It turns out that dragging a folder to a random location in
>>      Explorer is both trivially easy and sufficiently fast that the user
>>      may not notice, or may not connect the progress dialog with
>>      anything to mention later.
>>
>> _______________________________________________
>> PLUG discussion list: plug at plug.org.au
>> http://www.plug.org.au/mailman/listinfo/plug
>> Committee e-mail: committee at plug.linux.org.au
>>
>>     
>
>
>