recovering deleted files

[bdee1]

some files were accientally deleted from a disk on my unraid server.  can someone suggest a good file recovery software that i coudl use to get these files back?

[BillK]

Excellent question (i.e., I don't have an answer, but am very interested if someone else does).  unRAID uses the ReiserFS (3.6) file system, so I suspect any file "undelete" utility would need to come from the linux world.

[limetech]

Actually, yes there is something you can try.  The trick is to use the 'reiserfsck' program specifying the '-scan-whole-partition' option.  This will cause the program to look around in unallocated disk space, trying to find files and pieces of files which used to exist.  It will put them all into a top-level directory called 'lost+found'.  It may or may not preserve the file names, and the files may or may not be complete and/or corrupted.

 

Before attempting this I recommend you make a backup copy of any critical data still on the disk.

 

1. Start the array as normal.

 

2. telnet into the server and type the command: 'samba stop'.  This will take all the shares off the network.

 

3. type the command:

 

  df

 

This will show you all the "mounted" disks.  The ones of interest are:

/dev/md1
/dev/md2

etc.

These are all your data disks (md1 corresponds to disk1, md2 to disk2, etc.)

 

3. Decide which disk you want to recover, for example, let's say disk5.  Type the command:

 

 umount  /dev/md5

 

Notice the command is indeed 'umount' and not 'unmount'.

 

4. Now type:

 

  reiserfsck  --rebuild-tree --scan-whole-partition  /dev/md5

 

(instead of 'md5' use the correct identifier for the disk you're trying to recover).

 

When prompted, type 'Yes'.  Let this run - it might take a long time.

 

More info can be had here.

 

5. Once complete go back to the Management Utility, Stop the array, then Start array again.

 

Good Luck!

[bdee1]

thanks for posting this!  i ran through the steps exactly as posted but after typing reiserfsck  --rebuild-tree --scan-whole-partition  /dev/md5

  and then typing yes - it almost immediately just kicked me back to the prompt.

 

then i went in my web browser and tried to hit the management utility and it will no load - page not found.

 

what do i do?

[bdee1]

ok nevermind - i ran it again and this tyime typed yes with a uppercase Y and and now it says the following and seems to be running

so when it finishes, if i go to a web browser and load the management utility it shoudl load right?  i dotn have to reboot the unraid server or do anythign to manually re mount the disk or restart samba?

 

Replaying journal..

Reiserfs journal '/dev/md6' in blocks [18..8211]: 0 transactions replayed

###########

reiserfsck --rebuild-tree started at Sat Apr 14 12:36:03 2007

###########

 

Pass 0:

####### Pass 0 #######

The whole partition (30015208 blocks) is to be scanned

Skipping 9126 blocks (super block, journal, bitmaps) 30006082 blocks will be rea

d

0%.                                                  left 28719450, 14456 /sec

[bdee1]

ok sorry for all the posts but i just restarted samba "samba start" and then hit the web interface and stopped and started the array and now when i go to the disc 6 share on the network i see the lost+found folder with a bunch of stuff in it.

 

unfortunately the file(s) i was hoping to recover dont seem to be in there.

 

looking back on this whole experience it seems like this woudl be an excellent feature request for the next version of unraid - some kind of user friendly undelete feature.

[tomb]

What about a feature like the Network Appliance boxes have called snapshot.  Essentially, there are hidden snapshot directories created at given intervals.  We have used nightly and hourly.  You can get back the last four hours of changes, and from there, it is a snapshot each night.  Not all files are stored, just what is changed.

[bdee1]

that woudl be cool.

[Gog]

I tried this to recover deleted files.  The "reiserfsck  --rebuild-tree --scan-whole-partition  /dev/mdx" command came back, I did "samba start", went to the web interface, stopped it and it stopped responding.  The telnet sessions were still active so after a few minutes I rebooted the box.

 

Now the web interface isn't coming back online.

 

The network drives are there, I can access my shares and everything (although not the files I was hoping to undelete.  lost+found was not created)

 

edit: correction.  I can access all my \\tower\diskX but my user shares are not reliable.  Some work OK, some others I can't connect to.

 

How can I kick start the web interface ?

 

thanks

 

Gog

[RobJ]

Another tool that *might* help recover lost files is PhotoRec:  http://www.cgsecurity.org/wiki/PhotoRec.

 

There's a paragraph on that page that explains why it is especially difficult recovering files from a ReiserFS system, used by unRAID data disks.

 

[BLKMGK]

Tom, waaaay back there was some talk about enabling the Trashcan on the drives. Did that fall off the plate? I seem to recall it shows up as something like .trash or somesuch on other NAS I've used - the Buffalo NAS have this. Would this be hard to implement? I know it saved my bacon pretty good on my Buffalo once upon a time!