Hi, I remove one directory by running rm -fr ./some-dir. How to restore the directory and its files in the directory? Thanks! Regards Andrew
On Wed, Sep 16, 2020 at 07:21:08PM +0800, qw wrote:> I remove one directory by running rm -fr ./some-dir. How to restore > the directory and its files in the directory?If you don't have backups, then you're pretty much out of luck. Don't forget to back up any data that is important, and test your backups regularly! Depending on the filesystem, there might be ways to recover it, but the first thing you need to do is stop using the disk the files were on. Power it off. There are some tools that you can use to recover it, but it's not 100% effective. If it's very important and you are willing to spend money, there are data recovery services that might be able to extract the data. -- Jonathan Billings <billings at negate.org>
Hi, Thanks for your reply. The file system type is xfs. And I found xfsdump/xfsrestore can undo the remove. I use dd to copy the partition as one image file. How do I mount the image as read-only device? Then I can try to recover the deleted files/directory anytime. Thanks! Regards Andrew At 2020-09-16 20:36:44, "Jonathan Billings" <billings at negate.org> wrote:>On Wed, Sep 16, 2020 at 07:21:08PM +0800, qw wrote: >> I remove one directory by running rm -fr ./some-dir. How to restore >> the directory and its files in the directory? > >If you don't have backups, then you're pretty much out of luck. Don't >forget to back up any data that is important, and test your backups >regularly! > >Depending on the filesystem, there might be ways to recover it, but >the first thing you need to do is stop using the disk the files were >on. Power it off. There are some tools that you can use to recover >it, but it's not 100% effective. > >If it's very important and you are willing to spend money, there are >data recovery services that might be able to extract the data. > >-- >Jonathan Billings <billings at negate.org> >_______________________________________________ >CentOS mailing list >CentOS at centos.org >https://lists.centos.org/mailman/listinfo/centos
On 2020-09-16 06:21, qw wrote:> Hi, > > > I remove one directory by running rm -fr ./some-dir. How to restore the directory and its files in the directory? >1. restore from latest backup. 2. if you are very facile with Linux, then you culd try a. remount read only the mount point where removed directory/file lives (every write may obliterate some of removed stuff) - AS SOON AS POSSIBLE b. make dd copy of the whole partition (underlying device actually) to file, make another copy of that, and use filesystem debugging tools to undo what your "rm -rf ..." did on that copy. But this option is for experts in the field, which judging from your question you are not, so go to 1. Or go to 3. 3. send drive to one of commercial recovery companies. They charge a lot ($1000 will be good of least expensive ones, who charge much less are likely just frauds), the real ones, as they will try to do what is in 2. If you need advise on recovery companies, I can give some, though my own plan always is: I have a good backup. Valeri> Thanks! > > > Regards > > > Andrew > _______________________________________________ > CentOS mailing list > CentOS at centos.org > https://lists.centos.org/mailman/listinfo/centos >-- ++++++++++++++++++++++++++++++++++++++++ Valeri Galtsev Sr System Administrator Department of Astronomy and Astrophysics Kavli Institute for Cosmological Physics University of Chicago Phone: 773-702-4247 ++++++++++++++++++++++++++++++++++++++++