[Samba] Re: [Lrlug-discuss]emergency....file/directory recovery

[Martyn Ranyard]

Not sure how well this is done, but there is a menu item in midnight comander 
for undelete (ext2).  It is GNU software, so should be well designed at least.

The other option is to use the VFS module to implement a recycle bin, and 
delete files from the recycle bin daily (cron job).  I beleive there is an 
example of this with the SAMBA source.

If you want more info on the second, post a new mail to the list, as a reply 
to this, people would expect me to know - I know it is possible, but not how.

Martyn

On Monday 03 June 2002 22:55, Barry Smoke wrote:
> We have had another instance of this.....
> since I am forwarding to other lists, "this" involves a lost file, due
> to accidental deletion.
>
> in this case, we had a backup, but from the backup time, till deletion
> time, a lot of data had been lost.
>
> So, we have not enough disk space to do hourly backups,
> novell allowed recovery of a lost file like this,
> so:
>
> is there a filesystem that we need to switch to, that is still linux
> compatible that has file recovery like this?.....journaled...?
>
> Is there an application level program, that keeps stuff that has been
> deleted?....besides backup, and backup often!?
>
> This is mostly a samba issue, for windows users....
> maybe there should be a samba plug-in, or a purge type structure built
> in to samba-core.
>
> This appears to be a real problem for us.
>
> I think this will plague other districts/organizations/businesses in the
> decision to move to linux, where using samba is possible, but at what
> cost to file integrity...(maybe integrity is not the right word...)
>
> Barry Smoke
> District Network Administrator
> Bryant Public Schools
> Bryant, AR
>
> On Mon, 2002-04-01 at 17:27, Bryan Voss wrote:
> > On Mon, 2002-04-01 at 17:01, Barry Smoke wrote:
> > > We were doing a re-install of our imagecast software on our samba
> > > server, and the install deleted the images folder with 3 years worth of
> > > images in it.  Can we get these back?
> >
> > The only info I have is for ext2 filesystems. Not sure how applicable it
> > is for other filesystems, so YMMV.
> >
> > 1) Take the system offline ***IMMEDIATELY***. Preferably by just
> > shutting it off without even doing a shutdown. The longer it runs, the
> > more likely your lost data has been overwritten. Even doing a proper
> > shutdown can overwrite some of the data.
> >
> > 2) Remove the drive/drives and hook them up to another system.
> >
> > 3) Mount the filesystem(s) read-only.
> >
> > 4) Download and compile The Coroner's Toolkit, which contains a couple
> > of utilities you will need: unrm and lazarus. You can get TCT at:
> > http://www.fish.com/tct/ . You may also want to get TCTUTILs from
> > http://www.cerias.purdue.edu/homes/carrier/forensics/ to get a nicer
> > interface for TCT.
> >
> > 5) Read http://www.fish.com/tct/help-recovering-file for a walkthrough.
> >
> > I did this a few years ago and it works, but it will probably take you
> > many many hours to do a recovery and then it will probably be only
> > partial. Some files will probably already be partially overwritten, so
> > you can expect some corrupted images and other problems. As Nathan said,
> > backups are the only good recovery path, but it's obviously a little
> > late for that now.
> >
> > Also note the things you find that that can be partially recovered. An
> > eye opener from a security standpoint. You'll probably find files dating
> > back to the time that filesystem was put into use.
> >
> >
> > --
> > \\//
> > Bryan Voss
> >   bvoss at vosswerx.com
> >     PGP Key: http://www.vosswerx.com/bvoss/pgpkey.txt
> >
> > _______________________________________________
> > Lrlug-discuss mailing list
> > Lrlug-discuss at lrlug.org
> > http://lrlug.org/cgi-bin/mailman/listinfo/lrlug-discuss