samba - Jun 2002 - Re: [Lrlug-discuss]emergency....file/directory recovery

We have had another instance of this.....
since I am forwarding to other lists, "this" involves a lost file, due
to accidental deletion.

in this case, we had a backup, but from the backup time, till deletion
time, a lot of data had been lost.

So, we have not enough disk space to do hourly backups, 
novell allowed recovery of a lost file like this, 
so:

is there a filesystem that we need to switch to, that is still linux
compatible that has file recovery like this?.....journaled...?

Is there an application level program, that keeps stuff that has been
deleted?....besides backup, and backup often!?

This is mostly a samba issue, for windows users....
maybe there should be a samba plug-in, or a purge type structure built
in to samba-core.

This appears to be a real problem for us.

I think this will plague other districts/organizations/businesses in the
decision to move to linux, where using samba is possible, but at what
cost to file integrity...(maybe integrity is not the right word...)

Barry Smoke
District Network Administrator
Bryant Public Schools
Bryant, AR



On Mon, 2002-04-01 at 17:27, Bryan Voss wrote:
> On Mon, 2002-04-01 at 17:01, Barry Smoke wrote:
> > We were doing a re-install of our imagecast software on our samba
> > server, and the install deleted the images folder with 3 years worth
of
> > images in it.  Can we get these back?
> 
> The only info I have is for ext2 filesystems. Not sure how applicable it
> is for other filesystems, so YMMV.
> 
> 1) Take the system offline ***IMMEDIATELY***. Preferably by just
> shutting it off without even doing a shutdown. The longer it runs, the
> more likely your lost data has been overwritten. Even doing a proper
> shutdown can overwrite some of the data.
> 
> 2) Remove the drive/drives and hook them up to another system.
> 
> 3) Mount the filesystem(s) read-only.
> 
> 4) Download and compile The Coroner's Toolkit, which contains a couple
> of utilities you will need: unrm and lazarus. You can get TCT at:
> http://www.fish.com/tct/ . You may also want to get TCTUTILs from
> http://www.cerias.purdue.edu/homes/carrier/forensics/ to get a nicer
> interface for TCT.
> 
> 5) Read http://www.fish.com/tct/help-recovering-file for a walkthrough.
> 
> I did this a few years ago and it works, but it will probably take you
> many many hours to do a recovery and then it will probably be only
> partial. Some files will probably already be partially overwritten, so
> you can expect some corrupted images and other problems. As Nathan said,
> backups are the only good recovery path, but it's obviously a little
> late for that now.
> 
> Also note the things you find that that can be partially recovered. An
> eye opener from a security standpoint. You'll probably find files
dating
> back to the time that filesystem was put into use.
> 
> 
> -- 
> \\//
> Bryan Voss
>   bvoss@vosswerx.com
>     PGP Key: http://www.vosswerx.com/bvoss/pgpkey.txt
> 
> _______________________________________________
> Lrlug-discuss mailing list
> Lrlug-discuss@lrlug.org
> http://lrlug.org/cgi-bin/mailman/listinfo/lrlug-discuss

On Mon, Jun 03, 2002 at 04:55:44PM -0500, Barry Smoke
wrote:
> We have had another instance of this.....
> since I am forwarding to other lists, "this" involves a lost
file, due
> to accidental deletion.
> in this case, we had a backup, but from the backup time, till deletion
> time, a lot of data had been lost.
> So, we have not enough disk space to do hourly backups, 
> novell allowed recovery of a lost file like this, 
> so:
> is there a filesystem that we need to switch to, that is still linux
> compatible that has file recovery like this?.....journaled...?
> Is there an application level program, that keeps stuff that has been
> deleted?....besides backup, and backup often!?
> This is mostly a samba issue, for windows users....
> maybe there should be a samba plug-in, or a purge type structure built
> in to samba-core.
> This appears to be a real problem for us.
> I think this will plague other districts/organizations/businesses in the
> decision to move to linux, where using samba is possible, but at what
> cost to file integrity...(maybe integrity is not the right word...)
As I'm sure the people on the Samba list (whom you've cc:ed) will be
happy
to tell you, there is a "vfs trashcan" implementation available for
Samba
2.2 and above.  I believe it's part of the main Samba source in the Samba
3.0 CVS and will soon be built by default there; I'm not exactly sure what 
you have to do to get this for Samba 2.2.x, and will defer to Samba list
denizens.

Steve Langasek
postmodern programmer

> On Mon, 2002-04-01 at 17:27, Bryan Voss wrote:
> > On Mon, 2002-04-01 at 17:01, Barry Smoke wrote:
> > > We were doing a re-install of our imagecast software on our samba
> > > server, and the install deleted the images folder with 3 years
worth of
> > > images in it.  Can we get these back?
> > 
> > The only info I have is for ext2 filesystems. Not sure how applicable
it
> > is for other filesystems, so YMMV.
> > 
> > 1) Take the system offline ***IMMEDIATELY***. Preferably by just
> > shutting it off without even doing a shutdown. The longer it runs, the
> > more likely your lost data has been overwritten. Even doing a proper
> > shutdown can overwrite some of the data.
> > 
> > 2) Remove the drive/drives and hook them up to another system.
> > 
> > 3) Mount the filesystem(s) read-only.
> > 
> > 4) Download and compile The Coroner's Toolkit, which contains a
couple
> > of utilities you will need: unrm and lazarus. You can get TCT at:
> > http://www.fish.com/tct/ . You may also want to get TCTUTILs from
> > http://www.cerias.purdue.edu/homes/carrier/forensics/ to get a nicer
> > interface for TCT.
> > 
> > 5) Read http://www.fish.com/tct/help-recovering-file for a
walkthrough.
> > 
> > I did this a few years ago and it works, but it will probably take you
> > many many hours to do a recovery and then it will probably be only
> > partial. Some files will probably already be partially overwritten, so
> > you can expect some corrupted images and other problems. As Nathan
said,
> > backups are the only good recovery path, but it's obviously a
little
> > late for that now.
> > 
> > Also note the things you find that that can be partially recovered. An
> > eye opener from a security standpoint. You'll probably find files
dating
> > back to the time that filesystem was put into use.
> > 
> > 
> > -- 
> > \\//
> > Bryan Voss
> >   bvoss@vosswerx.com
> >     PGP Key: http://www.vosswerx.com/bvoss/pgpkey.txt
> > 
> > _______________________________________________
> > Lrlug-discuss mailing list
> > Lrlug-discuss@lrlug.org
> > http://lrlug.org/cgi-bin/mailman/listinfo/lrlug-discuss
> 
> 
> 
> 
> 
> _______________________________________________
> K12OSN mailing list
> K12OSN@redhat.com
> https://listman.redhat.com/mailman/listinfo/k12osn
> For more info see <http://www.k12os.org>

Not sure how well this is done, but there is a menu item in midnight comander 
for undelete (ext2).  It is GNU software, so should be well designed at least.

The other option is to use the VFS module to implement a recycle bin, and 
delete files from the recycle bin daily (cron job).  I beleive there is an 
example of this with the SAMBA source.

If you want more info on the second, post a new mail to the list, as a reply 
to this, people would expect me to know - I know it is possible, but not how.

Martyn

On Monday 03 June 2002 22:55, Barry Smoke wrote:
> We have had another instance of this.....
> since I am forwarding to other lists, "this" involves a lost
file, due
> to accidental deletion.
>
> in this case, we had a backup, but from the backup time, till deletion
> time, a lot of data had been lost.
>
> So, we have not enough disk space to do hourly backups,
> novell allowed recovery of a lost file like this,
> so:
>
> is there a filesystem that we need to switch to, that is still linux
> compatible that has file recovery like this?.....journaled...?
>
> Is there an application level program, that keeps stuff that has been
> deleted?....besides backup, and backup often!?
>
> This is mostly a samba issue, for windows users....
> maybe there should be a samba plug-in, or a purge type structure built
> in to samba-core.
>
> This appears to be a real problem for us.
>
> I think this will plague other districts/organizations/businesses in the
> decision to move to linux, where using samba is possible, but at what
> cost to file integrity...(maybe integrity is not the right word...)
>
> Barry Smoke
> District Network Administrator
> Bryant Public Schools
> Bryant, AR
>
> On Mon, 2002-04-01 at 17:27, Bryan Voss wrote:
> > On Mon, 2002-04-01 at 17:01, Barry Smoke wrote:
> > > We were doing a re-install of our imagecast software on our samba
> > > server, and the install deleted the images folder with 3 years
worth of
> > > images in it.  Can we get these back?
> >
> > The only info I have is for ext2 filesystems. Not sure how applicable
it
> > is for other filesystems, so YMMV.
> >
> > 1) Take the system offline ***IMMEDIATELY***. Preferably by just
> > shutting it off without even doing a shutdown. The longer it runs, the
> > more likely your lost data has been overwritten. Even doing a proper
> > shutdown can overwrite some of the data.
> >
> > 2) Remove the drive/drives and hook them up to another system.
> >
> > 3) Mount the filesystem(s) read-only.
> >
> > 4) Download and compile The Coroner's Toolkit, which contains a
couple
> > of utilities you will need: unrm and lazarus. You can get TCT at:
> > http://www.fish.com/tct/ . You may also want to get TCTUTILs from
> > http://www.cerias.purdue.edu/homes/carrier/forensics/ to get a nicer
> > interface for TCT.
> >
> > 5) Read http://www.fish.com/tct/help-recovering-file for a
walkthrough.
> >
> > I did this a few years ago and it works, but it will probably take you
> > many many hours to do a recovery and then it will probably be only
> > partial. Some files will probably already be partially overwritten, so
> > you can expect some corrupted images and other problems. As Nathan
said,
> > backups are the only good recovery path, but it's obviously a
little
> > late for that now.
> >
> > Also note the things you find that that can be partially recovered. An
> > eye opener from a security standpoint. You'll probably find files
dating
> > back to the time that filesystem was put into use.
> >
> >
> > --
> > \\//
> > Bryan Voss
> >   bvoss@vosswerx.com
> >     PGP Key: http://www.vosswerx.com/bvoss/pgpkey.txt
> >
> > _______________________________________________
> > Lrlug-discuss mailing list
> > Lrlug-discuss@lrlug.org
> > http://lrlug.org/cgi-bin/mailman/listinfo/lrlug-discuss