[Samba] Re: [Lrlug-discuss]emergency....file/directory recovery

[Barry Smoke]

We have had another instance of this.....
since I am forwarding to other lists, "this" involves a lost file, due
to accidental deletion.

in this case, we had a backup, but from the backup time, till deletion
time, a lot of data had been lost.

So, we have not enough disk space to do hourly backups, 
novell allowed recovery of a lost file like this, 
so:

is there a filesystem that we need to switch to, that is still linux
compatible that has file recovery like this?.....journaled...?

Is there an application level program, that keeps stuff that has been
deleted?....besides backup, and backup often!?

This is mostly a samba issue, for windows users....
maybe there should be a samba plug-in, or a purge type structure built
in to samba-core.

This appears to be a real problem for us.

I think this will plague other districts/organizations/businesses in the
decision to move to linux, where using samba is possible, but at what
cost to file integrity...(maybe integrity is not the right word...)

Barry Smoke
District Network Administrator
Bryant Public Schools
Bryant, AR



On Mon, 2002-04-01 at 17:27, Bryan Voss wrote:
> On Mon, 2002-04-01 at 17:01, Barry Smoke wrote:
> > We were doing a re-install of our imagecast software on our samba
> > server, and the install deleted the images folder with 3 years worth of
> > images in it.  Can we get these back?
> 
> The only info I have is for ext2 filesystems. Not sure how applicable it
> is for other filesystems, so YMMV.
> 
> 1) Take the system offline ***IMMEDIATELY***. Preferably by just
> shutting it off without even doing a shutdown. The longer it runs, the
> more likely your lost data has been overwritten. Even doing a proper
> shutdown can overwrite some of the data.
> 
> 2) Remove the drive/drives and hook them up to another system.
> 
> 3) Mount the filesystem(s) read-only.
> 
> 4) Download and compile The Coroner's Toolkit, which contains a couple
> of utilities you will need: unrm and lazarus. You can get TCT at:
> http://www.fish.com/tct/ . You may also want to get TCTUTILs from
> http://www.cerias.purdue.edu/homes/carrier/forensics/ to get a nicer
> interface for TCT.
> 
> 5) Read http://www.fish.com/tct/help-recovering-file for a walkthrough.
> 
> I did this a few years ago and it works, but it will probably take you
> many many hours to do a recovery and then it will probably be only
> partial. Some files will probably already be partially overwritten, so
> you can expect some corrupted images and other problems. As Nathan said,
> backups are the only good recovery path, but it's obviously a little
> late for that now.
> 
> Also note the things you find that that can be partially recovered. An
> eye opener from a security standpoint. You'll probably find files dating
> back to the time that filesystem was put into use.
> 
> 
> -- 
> \\//
> Bryan Voss
>   bvoss at vosswerx.com
>     PGP Key: http://www.vosswerx.com/bvoss/pgpkey.txt
> 
> _______________________________________________
> Lrlug-discuss mailing list
> Lrlug-discuss at lrlug.org
> http://lrlug.org/cgi-bin/mailman/listinfo/lrlug-discuss