Results 1 to 3 of 3
Enjoy an ad free experience by logging in. Not a member yet? Register.
- 09-15-2012 #1
- Join Date
- Jan 2012
how to recover from deleted files (rm -r )
yesterday I ran sudo rm -r and deleted everything from my 120GB external drive I salvaged from a dead laptop (in one of those Thermaltake BlacX things). it was all music & *.img files, so I'm not going to loose too much sleep over it, but I would love to know how to recover from this.
I donwloaded TestDisk 6.13 and it had no problems finding the 1st partition (the toshiba recovery partition I assume). For the other partition, I could only get a list of inode_xx files using the UNDELETE feature. I tried copying random files to my home directory and opening them with VLC but always got an error. There has been no activity on the drive since, so I know all the deleted data is still there.
- what are these inode_nn files and how/can I recover them to a usable file with the correct name?
- is TestDisk the right tool for the job?
- So long as I don't write more data to this drive, can I be 100/70/50% assured of recovering my stuff?
Last edited by kevcoder; 09-15-2012 at 05:59 PM. Reason: grammer
- 09-16-2012 #2
- Join Date
- May 2011
Yes testdisk is one of the tools you'll need, but there's more to it. But the first thing you really should do is duplicate the disk (with dd) if you have the time, and shut down the system, if it is your primary drive, and boot with it as an auxiliary drive that is not automounted.
I would personally use a Live Linux Rescue CD to do the recovery work. I'd check out SystemRescueCD:
It contains testdisk, ddrescue and other necessary tools to do the job.
Check out this guide (debian-based) for an explanation of the tools and processes. It is not the best guide, but it will give you an idea what to look for if you want to dig in:
Recovering from file system corruption using TestDisk
- 09-18-2012 #3
- Join Date
- Jun 2012
- SF Bay area
If you just deleted the files and didn't repartition the disk, then you should be able to mount the filesystems (you can mount then read-only if you want to be certain nothing is written to them). Then you could try using PhotoRec, the website is PhotoRec - CGSecurity to recover the deleted files.