HOW TO RECOVER DELETED FILES FROM SOLARIS 5.9 MACHINE
chah...@rediffmail.com
We had some very impotant scripts on a solaris 5.9 machine, but those
files have got deleted by mistake.
Is there any way, by which we can recover all those files?
Please share your knowledge on the same and help us in resolving this
issue.
Thank you,
-Neelam Chahar
neelam...@oracle.com
"Thommy M. Malmström"
> Hi All,
>
> We had some very impotant scripts on a solaris 5.9 machine, but those
> files have got deleted by mistake.
> Is there any way, by which we can recover all those files?
> Please share your knowledge on the same and help us in resolving this
> issue.
Restore from backup! If something is "very impotant" you have backups, haven't you?
Richard B. Gilbert
Restore them from a recent backup. You DO make regular disk backups
don't you?
Marc
> There is a REMOTE possibility that if you physically write protected the
> disk ASAP and halted the system that a forensic disk restore of the
> files might be possible at about $10K a go with no guarantee.
There are so many free utilities to try and recover files from an ext2 fs
on linux (but far less for ext3, despite their closeness) that I doubt
there is none that would work on solaris ufs. Randomly checking on the
web, photorec might be able to get something, although there is no
mention of UFS.
Note that obviously you can't expect to recover everything perfectly.
Mark
Funny thing is, I just KNEW when I saw this post, the next 5 responses
would be "restore from backup" ;)
Anyway, I have never heard of anyone actually using this, but I found
this when googling for "Solaris data recovery" :
http://www.stellarinfo.com/solaris-data-recovery.htm
Maybe you could give it a shot - if it works, let us know.
Alternatively, you could try using dd on on the disk device, capture
the output in a file somewhere and trawl through it with "strings"
looking for bits that match your scripts.
Oh, and if you hadn't immediately stopped all write access to the disk
involved, then you're probably straight out of luck anyway - the
blocks containing your data are probably long overwritten...
-Mark
Alex Mizrahi
(you :wrote :on '(Fri, 25 May 2007 19:12:56 +0000 (UTC)))
(
??>> There is a REMOTE possibility that if you physically write protected
??>> the disk ASAP and halted the system that a forensic disk restore of
??>> the files might be possible at about $10K a go with no guarantee.
there lots of software to restore from FAT and NTFS on Windows machines, and
it really works -- i've successfully restored ocassionaly deleted files many
times, on live system without any halting etc. is UFS so different?
M> There are so many free utilities to try and recover files from an ext2
M> fs on linux (but far less for ext3, despite their closeness) that I
M> doubt there is none that would work on solaris ufs. Randomly checking on
M> the web, photorec might be able to get something, although there is no
M> mention of UFS.
it should be possible to grep through all data on physicall disk, no? i've
done it on linux, and have found my files. with no additional software --
just grepping on block device.
)
(With-best-regards '(Alex Mizrahi) :aka 'killer_storm)
"I am everything you want and I am everything you need")
Rich Teer
> there lots of software to restore from FAT and NTFS on Windows machines, and
> it really works -- i've successfully restored ocassionaly deleted files many
> times, on live system without any halting etc. is UFS so different?
Yes. On FAT/NTFS, deleting a file consisted more or less of just setting a
bit in the first character of the file's name, so to undelete it you just
clear that bit. UFS is very different.
> it should be possible to grep through all data on physicall disk, no? i've
> done it on linux, and have found my files. with no additional software --
> just grepping on block device.
You've been very lucky. There's no guarantee that the blocks of a file
will be contiguous or in the "right" order. Good luck trying to find
all the blocks of a deleted 10 MB binary file, which are scattered all
over the disk...
--
Rich Teer, SCSA, SCNA, SCSECA, OGB member
CEO,
My Online Home Inventory
Voice: +1 (250) 979-1638
URLs: http://www.rite-group.com/rich
http://www.myonlinehomeinventory.com
Bob Nelson
> On Sat, 26 May 2007, Alex Mizrahi wrote:
>
>> there lots of software to restore from FAT and NTFS on Windows machines,
>> and it really works -- i've successfully restored ocassionaly deleted
>> files many times, on live system without any halting etc. is UFS so
>> different?
>
> Yes. On FAT/NTFS, deleting a file consisted more or less of just setting
> a bit in the first character of the file's name, so to undelete it you
> just clear that bit. UFS is very different.
...and it's superior in every possible way, too. The fact that NTFS/FAT
allow for recovery of deleted files was a /very/ poor design decision and
is fraught with numerous security holes. If you remove a file on a real
operating system, the file is removed because Unix respects your wishes and
doesn't treat you like a mistake-prone child.
Rich Teer
> ...and it's superior in every possible way, too. The fact that NTFS/FAT
> allow for recovery of deleted files was a /very/ poor design decision and
> is fraught with numerous security holes. If you remove a file on a real
> operating system, the file is removed because Unix respects your wishes and
> doesn't treat you like a mistake-prone child.
100% agreed; I was being uncharacteristically charitable to the "designers"
of those "file systems". ;-)
Dave
did not say what he has.
Casper H.S. Dik
>You've been very lucky. There's no guarantee that the blocks of a file
>will be contiguous or in the "right" order. Good luck trying to find
>all the blocks of a deleted 10 MB binary file, which are scattered all
>over the disk...
Especially if the disks have been in use for some time.
When one of our customers was hit by an accidental remove of */*
on some of the database disks (no backups either), I brushed of some
tools I had to do statistical analysis of data.
The difficulty of recover UFS lies in the fact that inodes are zerod
so you no longer have the 12 odd block pointers that hold the file
together.
You can easily tell the difference between a data block, indirect
block or double/triple indirect block; recovering the large database
files proofed relatively easy; those filesystems had only ever contain
those large files. Typically the first direct blocks are laid out
consecutively so the problem becomes:
- find the sequence of 8 direct blocks
- find the indirect block (a block full of block pointers)
- find the double block (a block full of pointers to blocks of
pointers)
Then some other folks did the gruntwork to recover the files on the other
disks.
Casper
Thomas Dickey
> there lots of software to restore from FAT and NTFS on Windows machines, and
> it really works -- i've successfully restored ocassionaly deleted files many
> times, on live system without any halting etc. is UFS so different?
yes: NTFS, etc., have a directory which includes all files on a disk,
while UFS doesn't (it's scattered around in individual directory files
and - depending on the storage scheme for those files(*) - is generally
lost when deleting a file. For both, the problem of overwriting parts of
a deleted file exists (since it's common to both, it's irrelevant).
(*) I'm aware it's more complicated than that, but did not notice any
technically competant discussion of this in the thread.
--
Thomas E. Dickey
http://invisible-island.net
ftp://invisible-island.net
Latheef Accel New Delhi
command, but I think it is possible using some third party utility
such as steller
On May 27, 11:46 am, Thomas Dickey <dic...@saltmine.radix.net> wrote:
Angel León O
Marco Moock
> Your answer is very stupid, I think, if chah had backup, he wouldn't
> be writing here.
from 2007.
And there is still: No backup, no pity.