Dir gone - how to get it back?

[rikona]

Wednesday, May 15, 2013, 3:56:23 AM, tv wrote:

> On 15/05/2013 11:38, Ric Moore wrote:
>> On 05/15/2013 01:14 AM, rikona wrote:
>>> I'm setting up a new 12.04 box. Just installed a few printers, which
>>> seemed to go OK - BUT, after that, one of my home dirs is GONE! Was a
>>> BIG one with about 1/3 of the stuff in home, and very important. Any
>>> idea of why just that dir [apparently] disappeared? Better still, any
>>> way to recover it? I can't see it via another admin account, or with
>>> the CLI. New box, a few days of intensive work, and didn't do a backup
>>> yet. :-(
>>>
>>> What's the best thing to do [not involving a large soothing glass of
>>> Scotch :-) ]?
>> 
>> Did you by any chance have it on it's own partition? (could but hope) so
>> you need to only remount it? Ric
>> 
>> 
>> 

> If you really can't find it :

> _has it been renamed to something funny, try looking for it with
> "ls -la"  in a console.

I tried that - but I was only looking for the 'real' name. Didn't
check for something funny. A good idea...

> _Look for it with a disk usage tool (baobab, filelight) or from a
> console with something like "du -a ~ 2> /dev/null | sort -rg | less"

I'll try those.

> _assume it's been deleted, try forensic tools like "extundelete",
> "magicrescue" or "photorec" (from the "testdisc" package, good for many
> file types, not only images). Look into the "/lost+found" folder.

I had someone help me with those recently [unfortunately]. Recovery
was only partial - many came back with 0 size or corrupted. With
400,000 files, though, the biggest problem was trying to find the 300
or so 'missing' files not in the last backup. Essentially impossible
to do manually.

What I needed was a tool to compare the two sets and ID the 'missing'
ones in the recovery set, and ignore the ones that were the same. If
you have a suggestion for how to do that, please let me know - I may
need to do that again.

> If possible you should try to work from an image of the disk, or from
> another system (live-cd possibly), because if the folder has been
> deleted your system is probably overwriting it right now by reusing the
> freed space...

I did a bit of snooping, and when it seemed like there really was a
problem, I shut down the box, and it is still off. And, yes, I will
try to work with an image.

If I use a live-cd instead, and mount the disk so I can look at it,
does that also allow the possibility of overwrites? An image takes a
long time to make, and the live-cd might be quicker.

> Good luck.

Thanks - and many thanks for the detailed suggestions for how to
proceed. The above would be a good check list to keep handy when
disaster strikes...

-- 

 rikona