Undeleting Linux files

Up 12/02

Date: Thu, 12 Dec 2002 04:44:29 -0600 (CST)
To: Kees Cook
From: Jno
Subject: holy shit

To tell it in code and psuedocode...

• lynx /home/jno/og
  (I'm sitting at ..)
  .. delete, yes

oops!! just blew away "jno" in /home. Meant to delete a file below ".." - that's what you get for allowing Lynx to see dot files.

• close tty's
• root #
  (hash crontab entries)
• umount /home --> dont work, "busy"
• fuser -v -m /home --> dont work
• umount /home --> still dont work, "busy"
  hash hdb2 fstab entry:
• pico /etc/fstab - hash hdb2
  #/dev/hdb2 /home ext2 defaults 1 2
• reboot

.........................................

• root #
• echo lsdel | debugfs /dev/hdb2 > nodes-out
• pico nodes-out
  (delete up to Dec 10)
• cut -c1-6 nodes-out > nodes
• pico make-nodes
  awk '{ print "mi <" $1 ">\n\n\n\n\n\n\n\n0\n1"\
  \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n" }'
• chmod u+x make-nodes
• ./make-nodes < nodes | debugfs -w /dev/hdb2
  (a lot of stuff flies by the screen)
• e2fsck -fy /dev/hdb2
• pico /etc/fstab
  /dev/hdb2 /home ext2 defaults 1 2
• reboot

..........................................

• root #
• cd /home
• mkdir /home/jno

  (as root) 1200 files, all numbered, in /home/lost+found. Identified and changed the names (with "lynx .") of all the rc files. Found .addressbook, .addressbook.lu, .lynxrc, .pinerc, .bashrc, .bash_profile, .fetchmailrc, and some other files. Left most as numbered for later. Mail and scripts subdirectories came through in one piece with all the files labled. All the permissions came through correct. Some recent subdirectories didn't make it in one piece, though.

• mv /home/lost+found/* /home/jno/
• mv /home/lost+found/.* /home/jno/

phew!! Two days it took. The actual work was a few hours. But I tried mc first (it had worked smoothly in the past), but it hung badly (had to kill it), and the directions are now incorrect. That took most of a day.

Got web documentation, compared two sets, picked the best combination (no - I dont have a spare partition somewhere of 130 Meg), avoided all caution (I do have a Win backup of a month ago), and just started in.

The only good practice I have is that the "jno" home directory is more of a scratch file than anything else. When I lost it I had just downloaded and edited a couple hundred files, but only one minor one was still in /home/jno, all the final copies had been moved elsewhere. Just the same, gotta get "backup" organized better.

bye /jno

---

Website Provider: Outflux.net, www.Outflux.net
URL:http://jnocook.net/geek/undelete.htm

---