Undelete help please!!


Recommended Posts

If I have Ubuntu Lucid running on a Windows 7 dual boot machine with 4G of memory, could I remove the drive and attach it using a SATA to USB adapter and run the commands from there?

Absolutely.  It is a standard reiser file system.  You would need to run reiserfsck on the first partition.  So, if it is assigned as /dev/sdn, you'll need to run reiserfsck on /dev/sdn1

 

Note, doing this will invalidate parity, since it will not be updated at the same time, therefore you'll need to expect to run a full parity check once the disk is repaired AND expect there to be errors as it corrects parity to be in sync with the repaired drive.

If I just reboot, will it be ok, but just still missing the files?  They are some photos, so I may be able to find them elsewhere.

A reboot will not fix the file-system.
Link to comment
  • 1 year later...

This helped rescue over 500GB of PVR recordings after an errant "rm ..." command.  I'd say it took about a day for the reiserfsck to finish on a 2TB drive with 1GB of RAM.  I'd say I was able to recover over 90% of what I deleted, and most of it was even titled correctly. 

Link to comment
  • 1 month later...

Note: This process will only work if all files were on the same drive.

 

(Basically, you're forcing a simulated drive failure and rebuild)

 

So, I take it this means this process won't work on the cache drive?

wholly's statement is NOT accurate.  The process of unmounting, running rebuild-tree -S, does not simulate a failed disk and a reconstruct.  It simply un-mounts the disk so the file system repair can be performed.

 

It can be used on the cache disk, but it does not have a /dev/mdX device.

 

You will need to run the reiserfsck on /dev/sdX1

the first partition on the device used for the cache drive.

Link to comment

Thanks Joe!

 

Worked like a charm!

 

I had backed up a friend's laptop using Acronis, and had opened the image in R/W mode so I could change permissions and get into the User folder.  The laptop was taking forever to process the permission change (it's pretty old), so I cancelled out.  I deleted the 2nd image file that was created so I could start from scratch on my PC, but apparently that 2nd image file needs to be present to reopen the original image...  Doh!!!

 

Rebuild Tree got it back!    :D

Link to comment
  • 5 months later...

I apologize if this has already been answered.  Two questions:


  •  
     
    1.  Once I recover the files in "lost+found" how to I effectively decrypt the original file name?
    2.  For some reason the "disk share" is still visible even though I copied the "lost+found" contents to a local pc , deleted the "lost+found" folder from the disk and set "Disk shares (SMB)" to "Don't export" Any ideas?
     
    Running unRAID Server Pro v4.7
     
    Edit:  Further research indicates there is no easy, straight-forward method to decipher the original file name.  The date time stamp and file size seem to be the best clues.  Also, I found out that stopping and restarting the array eliminated the "disk share" that was still visable.  I answered my own questions.  :)

Link to comment
  • 6 months later...

Ok, I accidentally deleted some files then performed reiserfsck --rebuild-tree -S /dev/md1.  It completed and my drive is showing as ok and I have the lost+found folder on disk1 but it is just full of files & folders with a bunch of numbers?  I do see some of my files recovered but not all of them.  What do I do with the lost+found folder?

Link to comment

Ok, I accidentally deleted some files then performed reiserfsck --rebuild-tree -S /dev/md1.  It completed and my drive is showing as ok and I have the lost+found folder on disk1 but it is just full of files & folders with a bunch of numbers?  I do see some of my files recovered but not all of them.  What do I do with the lost+found folder?

Many of the folders and files will not have their original name, or even their original "extension"

 

You basically go through all the files and folders, using hints such as their size and folder to identify them.  Try re-naming them with the correct extension and opening them.  Using different programs to attempt to open them might help to identify their original names.

 

Some files might never be able to be recovered (if you've overwritten them) and you might find that others were on a different disk (you'll need to use the -S option on /dev/md2, etc if that is the case).

 

When you've identified all you can, or want, then you can delete the lost+found folder.

Link to comment

Ok, I accidentally deleted some files then performed reiserfsck --rebuild-tree -S /dev/md1.  It completed and my drive is showing as ok and I have the lost+found folder on disk1 but it is just full of files & folders with a bunch of numbers?  I do see some of my files recovered but not all of them.  What do I do with the lost+found folder?

Many of the folders and files will not have their original name, or even their original "extension"

 

You basically go through all the files and folders, using hints such as their size and folder to identify them.  Try re-naming them with the correct extension and opening them.  Using different programs to attempt to open them might help to identify their original names.

 

Sounds Fun, thanks for the help!  I guess it's better to have to do this then loose the files permenantly?

Link to comment
  • 3 months later...

So I was running reiserfsck --rebuild-tree -S /dev/md? on one of my drives from putty on one of my PCs but that PC happened to reboot from a windows update. Do I need to rerun reiserfsck or is there a way to putty back in and see what the status is on it?

 

Thanks

no way to recover unless you first installed and ran the command under "screen"

 

You must run the reiserfsck command again.

 

Joe L.

Link to comment
  • 9 months later...
  • 9 months later...

OMG!!  It happened to me.. I messed up with my sync program, some how it deleted all my pics.

Anyway long story short, I was able to recovered by using the method that mentioned here.

 

Now my peewee question is, Im on the Lost and Found folder I can see files like 13535_4534, 13556_444, I assumed those are the pictures.  How come I cant open the Lost and Found folder on my share drive(Disk1), but I can open the folder when I telnet into it? Do I need to copy those files to another folder or something?

 

Sorry i know this is very very old post :(

 

THanks

 

Link to comment
  • 5 years later...
On 1/15/2010 at 8:08 AM, Joe L. said:

Were they on your unRAId server?

 

If yes, then see this entry in the wiki:  http://lime-technology.com/wiki/index.php?title=FAQ#How_can_I_undelete_files_from_an_unRAID_disk.3F

 

In essence

 

stop samba  [all your shares will disappear from network]

killall smbd nmbd

 

un-mount the disk  (md1=disk1, md2=disk2, md10-disk10,  etc.  Use the correct disk for your needs. this example is for disk1)

umount /dev/md1

note the above command is umount, not unmount.

 

run reiserfsck on the disk to rebuild the file tree.  Any files that can be recovered will.  This process could take many hours for a large disk as the entire disk will need to be scanned.

reiserfsck --rebuild-tree -S /dev/md1

 

It will ask you to confirm the rebuild of the file tree. Make certain you answer Yes (three letters, Capital "Y", lower case "es")

Anything else will be considered as "no"

 

re-mount the disk  (again, use the correct "md" and "disk" for your situation)

mount /dev/md1 /mnt/disk1

 

re-start samba

/usr/sbin/smbd -D

/usr/sbin/nmbd -D

 

your deleted files (any that could be recovered) will be in a lost+found folder on the disk.

 

See here for a more general description of the process

http://antrix.net/journal/techtalk/reiserfs_data_recovery_howto.comments

 

 

Is this still a valid process with the latest UNRAID build?

 

Link to comment

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.