[pkdcet]

Hi,
One of my friend unknowingly due to some confusion(in stead of running the command on one shell he ran it on mine where pwd aws my home directory) deleted many files in my home dieory which is in ext3 partition. I had many files which were quite important. Can I recover them using some set of commands or any other trick?
Hoping for some positive responses,
-pkd

[TerryNet]

Use the drive as little as possible, so as to not overwrite the files.

Search for "recover Linux files." Here is one promising article.

[lotuseclat79]

Originally Posted by pkdcet

Hi,
One of my friend unknowingly due to some confusion(in stead of running the command on one shell he ran it on mine where pwd aws my home directory) deleted many files in my home dieory which is in ext3 partition. I had many files which were quite important. Can I recover them using some set of commands or any other trick?
Hoping for some positive responses,
-pkd

Hi pkdcet,

Ext3 has a journal, and if you are willing to slog through the details (it will take some effort if you have followed TerryNet's advice to essentially "do nothing" that would contaminate the contents of the driver before attempting to recover the files on it.

I would get another hard drive (at least as large) to do a Live CD sector backup using the dd command from your hosed hard drive to the backup hard drive first before doing anything else. This essentially clones your hosed hard drive - then you work with the clone to preserve the state of the original hard drive.

Here is a link to one of my posts: How to undelete removed files and directories on an ext3 file system.

Let us know what you decide to do and keep us informed of your progress.

-- Tom

P.S. Note:

Use the fdisk -l command to find the device names on your computer (from Live CD root account) or use the sudo fdisk -l command from a regular user account (from the Live CD regular default user account) - this will identify your Linux disk device name as opposed to any dual or multiple boot disks, e.g. Windows before you clone your hard drive which is the recommended procedure to follow.

Clone a harddisk

To clone a disk A to B, both disks need to have the same capacity. It is very convenient for USB disks. Say our USB disk source is called /dev/sdb and the target is called /dev/sdc. Do it like this:

dd if=/dev/sdb of=/dev/sdc

Now if sdc has a bigger capacity, this capacity will be lost because the file system is not aware of it.

Creating a hard drive backup directly to another hard drive

# dd if=/dev/hda of=/dev/sda conv=noerror,sync bs=4k

This command is used often to create a backup of a drive (/dev/hda) directly to another hard drive (/dev/sda). (The device name /dev/hda is typical of an IDE hard drive, the device /dev/sda is typical of a USB disk.) This works only if the hard drive has enough storage to accommodate the source drive's filesystem. The advantage of this is that you do not have to mount the hard drive to make a backup and the only reference to hda is in /dev and in the command which is usually in a script in cron.

The option "bs=4k" is used to specify the block size used in the copy. The default for the dd command is 512 bytes: use of this small block size can result in significantly slower copying. However, the tradeoff with larger block sizes is that when an error is encountered, the remainder of the block is filled with zero-bytes. So if you increase your block size when copying a failing device, you'll lose more data but also spend less time trying to read broken sectors. Tools like dd_rescue and dd_rhelp can provide a more flexible solution in such cases, combining the speed of a large block size for the regions without errors with finer-grained block-copies for regions with errors.