Recovering Deleted Files on ReiserFS3?

DarkSarin asks: "I have a rather serious problem: I managed to accidentally delete some files (rather important ones at that!) while trying to back them up to cd (I was using a GUI burning software that will remain nameless for now). How do you recover accidentally deleted files in Reiserfs? This thread (started by me) indicates that you can't recover them. Note that I had found a way to rebuild the tree, but that didn't work. It seems odd to me that you wouldn't be able to recover accidental deletions, but that really does seem to be the case. Help? Please?"

Try this

[Anonymous Coward]

I really don't understand how this was done. None the less you CAN recover from this. Here's a little tutorial I found. I Highly suggest doing the backup first!!! :

If you're really really desperate, you can do what I did a few weeks ago. In my \
case, fsck didn't recover the partition either, indeed it crashed. So here's what's \
I did from the beginning of what I think fixed it:

1) reiserfsck --rebuild-tree
2) mount
3) reiserfsck -S
4) debugreiserfs to get metadata for Vitaly
5) mount
6) mount again

I'm not sure why this happened, but after the second mount, the partition was not \
recognizeable as ReiserFS anymore. I suspect it had to do with a few really huge \
files that were originally on the partition that reisefsck -S tried to recover. In \
doing so it probably hosed lots of stuff. Now, it was as simple as

7) reiserfsck --rebuild-tree

And I had most of my data linked under lost+found! Took me a few hours to sort \
through it all but I got back most of what I cared about. Maybe if you use the new \
pre8 fsck you won't need to jump through these hoops. Since the potential for data \
destruction is high here, I wouldn't blame you for not trying. And yes, this all \
happened by trial and error ::-)

This might help too :
http://marc.theaimsgroup.com/?l=reiserfs&m=1048613 18421306&w=2 [theaimsgroup.com].

Good luck!

Ask Namesys

[cornice]

Pay Namesys $25. They wrote ReiserFS so they should know. You'll be getting really great support and helping those who wrote your file system. Look here:

http://www.namesys.com/support.html

Re:Name the program please

[martinde]

> If you had this problem then I or anyone will have this problem too, so please let us know what program you are talking about.
> Was a user error? Was it a bug? Is the bug being worked on?

I'm not poster so I don't know the answer to your question, but I will say I've accidently done this in K3b. I had files highlighted in the list of files to burn, AND there were files highlighted in the tree view of my filesystem. I hit the delete key thinking it would remove the ones from the list of files to burn; nope, it deleted them from the filesystem!

Re:More questions...

[zulux]

If a certain sequence of bits on the disk was originally 1011010010001011101001, and it got overwritten with 0110101101010010101111, how -- barring psychics, voodoo, and fairy dust -- can the original be recovered?

By reading the slop in between tracks. The writes look more like layers, with little bit of data poking out from the edges, to a scanning electron microscope.

Think of paint layers - at the edge, you can somtimes pick out the previous colors and the order that they were painted.

Of course, this isen't for meere mortals. People like the CIA get to play with this stuff.

Re:Good luck...

[xenocide2]

Actually, rotational storage is very different from standard memory. Its considered inefficient not to use as much RAM as possible because using one page is as useful as the next. There's a uniform cost across all areas of RAM. In contrast, one prefers linear writes in a disk because it improves throughput. Each page on disk is not identical in usage cost. What we're paying here is the oppertunity cost if we use a specific page in disk.

On the other hand, I agree that a marked for deletion queue makes a great use of "extra" disk space on a desktop system. But this use should not be forced on a filesystem that's used in a wide variety of different situations. Ideally, this idea can be done on top of the file system.

The way i did it

[jjshoe]

I managed to re-create the resier file system three times over 20 years of digital photos, with no backup ofcourse. I was able to replay the journal recovering all but the most recent photos.

I beleive i used the --rebuild-tree option. You should follow the steps in the manpage under Example.

so in short, man reiserfsck before asking slashdot :)

NetWare has...

[Anonymous Coward]

A filesystem has never (AFAIK) implemented a trash / recycle bin folder -- not on Windows or OS X, and not on any UNIX that I know of.

NetWare has had a very sophisticated file undeletion capability since time immemorial.

If Novell ports it to SuSE, you Linux clowns might just find yourselves in possession of a mission-critical operating system after all [not that you deserve it].

Well...to be fair.

[Anonymous Coward]

KDE has a trash bin too.

But in the context menu it asks you if you want to delete or move to trash. Not the same thing! In DOS, delete, or del usually just write a lowercase delta IIRC over the first character of the file name marking the space as free to be used.

Right now, his enemy is the "relatively" obscure file system, and how much writing he's done to the harddrive since the "incident".

Re:The Coroners Toolkit

[menscher]

Nice job karma-whoring, but TCT does NOT work with journaled filesystems.

Re:Good luck...

[SteveOU]

I will point out that the filesystems included in Novell's Netware product did include a deletion-recovery tool, accessible via the salvage command. My understanding was that Netware would not permantently delete a file until that disk space was needed for active data or until a timeout period expired.

Damned handy tool, too. We had IBM's TSM for our major backup operations, but for those "oops" moments, salvage was sure handy. I hope that the new Novell might consider implementing those features on existing linux filesystems, or at least contribute native linux implemenations of their filesystems.

Re:Good luck...

[Anonymous Coward]

And it wastes 5% of the space by default! That's 100 GB on a 2TB fs completely wasted! Always use -m0 on storage fs's or -m1 on system fs with mke2fs.

tune2fs can fix that after creating the filesystem. But it's not wasted space, it's just reserved for root (or another user ID, if you change it - useful as a cheap quota system).

ReiserFS v3 and v4 are pretty good with space efficiency. No space is reserved for inodes, and tail-packing means very little space is wasted storing the last block of a file.

Solution

[scheme]

Since ext3 is just ext2 with added features, you can undelete the file the way you would do so on ext2. There's actually an undelete howto for ext2. The basic gist of it is that you immediately unmount and remount the partition read only. Then you grab a list of last delete blocks and use that to recontruct the file. I've done it once or twice but I've been fortunate enough to have a tape backup solution that has been able to alleviate the need for this for a while now.

Re:More questions...

[Nucleon500]

It has to do with the analog nature of the storage. If you had 0, 1, 1, 0, and you overwrote that with zeros, you'd then have 0, .1, .1, 0. Chances are that the drive itself (without at least modified firmware) can't tell the difference, but a data recovery lab can. You can actually still read data after it's been written between 5 and 20 times - each time, subtract the obvious and multiply the residue.

Re:Name the program please

[DarkSarin]

The program, which I now feel safe in naming, was CDBakeOven 2.0 (yeah, I know, beta software and all that-it still shouldn't EVER do this!)

To the user who gave instructions on how to use rebuild tree, those are about the same steps
I used (same -S option) on --rebuild-tree, to no avail.

So, the end result is--thanks, but so far the best advice still seems to be to pay the $25 to the folks who made the fs. I may yet do that. In the mean time, I am using my sorry winXP install....

blech

Re:Good luck...

[isj]

A filesystem has never (AFAIK) implemented a trash / recycle bin folder -- not on Windows or OS X, and not on any UNIX that I know of.

Actually, OS/2 implemented it. It could be enabled/disabled per drive, the size of the trashcan could be configured, and it worked even for temporary files made by programs. And yes, it was somewhat slow.

Re:More questions...

[Gordonjcp]

People like the CIA get to play with this stuff.


Except that they don't. It's entirely a myth that the CIA can read multiply-overwritten data from hard disks. The idea that the tracks look like layers doesn't hold up - you'd have to use less and less write density every time. It doesn't happen that way.

Now, what you can do - and what does work - is look at the analogue signal from the head and see what the variance from an "average" one or zero is. So, if the head returns a 4mV pulse for a one, on average, then it's likely that a 4.1mV pulse used to be one last time, and a 3.9mV pulse used to be a zero. This is a gross oversimplification, but you get the idea. It works, but not very well.

Some file systems do have a trash can actually.

[TheSimkin]

Just FYI. Netware's file system does have a trashcan built in and will keep the files that you've deleted. Even multiple versions of them until ther is no room on the storage device, then it will start to actually delete the oldest deleted files at that point. It's quite useful! you can disable the function globally or just on a directory/tree also. It has been doing this since version 2 for sure. Possible even before that.