Recover deleted folders and their contents

[Paddy Landau]

I know this has probably been asked before, but my head is spinning a bit and I need some gentle guidance…

I have a partition formatted as ext4.

1. I mounted the partition.
2. I accidentally deleted three or four folders from the root of the partition.
3. I did nothing else whatsoever on the partition (no creating files, no editing, nothing).
4. I dismounted the partition.

Then I repeated this process on my backup partition, so the backups are also gone!

(Slaps head in frustration and cries out, "Doh!" This will teach me not to do backup work after I have taken my meds! )

How can I recover those folders and their contents?

[Bashing-om]

Paddy; Hi !

I am aware of this that "might" get your files back. Might be to your good to spend the time and effort in the research and see if you think it is doable from ubuntu.
http://linux.sys-con.com/node/117909?page=0,0

I would say luck to ya -- but it is mental effort that rewards.

[cortman]

Hey Paddy;

Guess you used rm to delete? (in other words, it's not as simple as checking Root's "trash"?)
Testdisk may be your best option.

[NM5TF]

take a look at testdisk...it may be what you need....go here:

http://www.cgsecurity.org/wiki/TestDisk

[Stonecold1995]

Yeah, I'd go with testdisk as well. But be warned, it's hard, if not impossible, to completely recover files from an ext4 filesystem. Once I accidentally deleted everything in /home and tried using testdisk/photorec to recover the files... I got a few files, but no filenames, directories, etc. Just randomly named files and corrupt files. So I wouldn't get my hopes up on recovering everything back to the way it was.

[Paddy Landau]

Thank you for all of your responses. Yes, it was a rm command — well, actually done with rsync.

I'm about to try Test Disk, which I see is available on the standard repositories.

Wish me luck. I'll post my results.

[Paddy Landau]

My results, unfortunately, are a big fat zero.

Test Disk finds the deleted folders without any problem, but reports each folder as being completely empty.

So, that means that I cannot restore the files.

Unless you have any clever suggestions, I shall have to live with their loss. Thank heavens my critical files are all backed up in the "cloud". These files are inconvenient to lose, but not devastating.

[Stonecold1995]

When you used TestDisk, the drive was mounted read-only, right? If it's mounted read-write then that can overwrite some of the deleted data you want to recover.

Also here's a suggestion. Before you start using the drive again, back up the whole partition to another drive (which can fit it of course).

sudo dd if=/dev/sdb1 of=/media/backup/sdb1.img # assuming sdb1 is the partition which you accidentally deleted files from

That way, if you ever in the future find a way to recover deleted files, you still have the drive image to work on. Low-level copying utilities like dd copy everything exactly as it is present on the disk, independent of the state of the filesystem (unlike commands like cp). This includes copying deleted files, corrupt date, filesystem errors, etc.

Also did you try PhotoRec, or is that done automatically by TestDisk. TestDisk, if I remember correctly, is used for fixing corrupt partitions with damaged filesystems, etc, whereas PhotoRec is desiged to recover deleted files on a working filesystem.

[Paddy Landau]

Also did you try PhotoRec, or is that done automatically by TestDisk. TestDisk, if I remember correctly, is used for fixing corrupt partitions with damaged filesystems, etc, whereas PhotoRec is desiged to recover deleted files on a working filesystem.

Thank you for that clarification; I was unaware of it. No, TestDisk does not run PhotoRec. TestDisk took mere seconds to run.

I am busy running PhotoRec now, which (it says) has over three hours to go. I'll post back once it has completed.

Edit: Well, it's 1¾ hours later and it says it still has 4 hours to go. I'll wait patiently

[The Cog]

PhotoRec creates lots of numbered folders, with lots of numbered files in each folder. No file or folder names - just sequential numbers. It will find many thousands of gif images from your browser cache. Sorting through the recovered files is a nightmare. If you are just looking for a few important documents, you could be thinking about what file contents you could search for while photorec is working. Good luck.