Barry Smoke
2002-Jun-03 15:01 UTC
[Samba] Re: [Lrlug-discuss]emergency....file/directory recovery
We have had another instance of this..... since I am forwarding to other lists, "this" involves a lost file, due to accidental deletion. in this case, we had a backup, but from the backup time, till deletion time, a lot of data had been lost. So, we have not enough disk space to do hourly backups, novell allowed recovery of a lost file like this, so: is there a filesystem that we need to switch to, that is still linux compatible that has file recovery like this?.....journaled...? Is there an application level program, that keeps stuff that has been deleted?....besides backup, and backup often!? This is mostly a samba issue, for windows users.... maybe there should be a samba plug-in, or a purge type structure built in to samba-core. This appears to be a real problem for us. I think this will plague other districts/organizations/businesses in the decision to move to linux, where using samba is possible, but at what cost to file integrity...(maybe integrity is not the right word...) Barry Smoke District Network Administrator Bryant Public Schools Bryant, AR On Mon, 2002-04-01 at 17:27, Bryan Voss wrote:> On Mon, 2002-04-01 at 17:01, Barry Smoke wrote: > > We were doing a re-install of our imagecast software on our samba > > server, and the install deleted the images folder with 3 years worth of > > images in it. Can we get these back? > > The only info I have is for ext2 filesystems. Not sure how applicable it > is for other filesystems, so YMMV. > > 1) Take the system offline ***IMMEDIATELY***. Preferably by just > shutting it off without even doing a shutdown. The longer it runs, the > more likely your lost data has been overwritten. Even doing a proper > shutdown can overwrite some of the data. > > 2) Remove the drive/drives and hook them up to another system. > > 3) Mount the filesystem(s) read-only. > > 4) Download and compile The Coroner's Toolkit, which contains a couple > of utilities you will need: unrm and lazarus. You can get TCT at: > http://www.fish.com/tct/ . You may also want to get TCTUTILs from > http://www.cerias.purdue.edu/homes/carrier/forensics/ to get a nicer > interface for TCT. > > 5) Read http://www.fish.com/tct/help-recovering-file for a walkthrough. > > I did this a few years ago and it works, but it will probably take you > many many hours to do a recovery and then it will probably be only > partial. Some files will probably already be partially overwritten, so > you can expect some corrupted images and other problems. As Nathan said, > backups are the only good recovery path, but it's obviously a little > late for that now. > > Also note the things you find that that can be partially recovered. An > eye opener from a security standpoint. You'll probably find files dating > back to the time that filesystem was put into use. > > > -- > \\// > Bryan Voss > bvoss@vosswerx.com > PGP Key: http://www.vosswerx.com/bvoss/pgpkey.txt > > _______________________________________________ > Lrlug-discuss mailing list > Lrlug-discuss@lrlug.org > http://lrlug.org/cgi-bin/mailman/listinfo/lrlug-discuss
Steve Langasek
2002-Jun-03 15:08 UTC
[Samba] Re: [K12OSN] Re: [Lrlug-discuss]emergency....file/directory recovery
On Mon, Jun 03, 2002 at 04:55:44PM -0500, Barry Smoke wrote:> We have had another instance of this..... > since I am forwarding to other lists, "this" involves a lost file, due > to accidental deletion.> in this case, we had a backup, but from the backup time, till deletion > time, a lot of data had been lost.> So, we have not enough disk space to do hourly backups, > novell allowed recovery of a lost file like this, > so:> is there a filesystem that we need to switch to, that is still linux > compatible that has file recovery like this?.....journaled...?> Is there an application level program, that keeps stuff that has been > deleted?....besides backup, and backup often!?> This is mostly a samba issue, for windows users.... > maybe there should be a samba plug-in, or a purge type structure built > in to samba-core.> This appears to be a real problem for us.> I think this will plague other districts/organizations/businesses in the > decision to move to linux, where using samba is possible, but at what > cost to file integrity...(maybe integrity is not the right word...)As I'm sure the people on the Samba list (whom you've cc:ed) will be happy to tell you, there is a "vfs trashcan" implementation available for Samba 2.2 and above. I believe it's part of the main Samba source in the Samba 3.0 CVS and will soon be built by default there; I'm not exactly sure what you have to do to get this for Samba 2.2.x, and will defer to Samba list denizens. Steve Langasek postmodern programmer> On Mon, 2002-04-01 at 17:27, Bryan Voss wrote: > > On Mon, 2002-04-01 at 17:01, Barry Smoke wrote: > > > We were doing a re-install of our imagecast software on our samba > > > server, and the install deleted the images folder with 3 years worth of > > > images in it. Can we get these back? > > > > The only info I have is for ext2 filesystems. Not sure how applicable it > > is for other filesystems, so YMMV. > > > > 1) Take the system offline ***IMMEDIATELY***. Preferably by just > > shutting it off without even doing a shutdown. The longer it runs, the > > more likely your lost data has been overwritten. Even doing a proper > > shutdown can overwrite some of the data. > > > > 2) Remove the drive/drives and hook them up to another system. > > > > 3) Mount the filesystem(s) read-only. > > > > 4) Download and compile The Coroner's Toolkit, which contains a couple > > of utilities you will need: unrm and lazarus. You can get TCT at: > > http://www.fish.com/tct/ . You may also want to get TCTUTILs from > > http://www.cerias.purdue.edu/homes/carrier/forensics/ to get a nicer > > interface for TCT. > > > > 5) Read http://www.fish.com/tct/help-recovering-file for a walkthrough. > > > > I did this a few years ago and it works, but it will probably take you > > many many hours to do a recovery and then it will probably be only > > partial. Some files will probably already be partially overwritten, so > > you can expect some corrupted images and other problems. As Nathan said, > > backups are the only good recovery path, but it's obviously a little > > late for that now. > > > > Also note the things you find that that can be partially recovered. An > > eye opener from a security standpoint. You'll probably find files dating > > back to the time that filesystem was put into use. > > > > > > -- > > \\// > > Bryan Voss > > bvoss@vosswerx.com > > PGP Key: http://www.vosswerx.com/bvoss/pgpkey.txt > > > > _______________________________________________ > > Lrlug-discuss mailing list > > Lrlug-discuss@lrlug.org > > http://lrlug.org/cgi-bin/mailman/listinfo/lrlug-discuss > > > > > > _______________________________________________ > K12OSN mailing list > K12OSN@redhat.com > https://listman.redhat.com/mailman/listinfo/k12osn > For more info see <http://www.k12os.org>
Martyn Ranyard
2002-Jun-04 02:08 UTC
[Samba] Re: [Lrlug-discuss]emergency....file/directory recovery
Not sure how well this is done, but there is a menu item in midnight comander for undelete (ext2). It is GNU software, so should be well designed at least. The other option is to use the VFS module to implement a recycle bin, and delete files from the recycle bin daily (cron job). I beleive there is an example of this with the SAMBA source. If you want more info on the second, post a new mail to the list, as a reply to this, people would expect me to know - I know it is possible, but not how. Martyn On Monday 03 June 2002 22:55, Barry Smoke wrote:> We have had another instance of this..... > since I am forwarding to other lists, "this" involves a lost file, due > to accidental deletion. > > in this case, we had a backup, but from the backup time, till deletion > time, a lot of data had been lost. > > So, we have not enough disk space to do hourly backups, > novell allowed recovery of a lost file like this, > so: > > is there a filesystem that we need to switch to, that is still linux > compatible that has file recovery like this?.....journaled...? > > Is there an application level program, that keeps stuff that has been > deleted?....besides backup, and backup often!? > > This is mostly a samba issue, for windows users.... > maybe there should be a samba plug-in, or a purge type structure built > in to samba-core. > > This appears to be a real problem for us. > > I think this will plague other districts/organizations/businesses in the > decision to move to linux, where using samba is possible, but at what > cost to file integrity...(maybe integrity is not the right word...) > > Barry Smoke > District Network Administrator > Bryant Public Schools > Bryant, AR > > On Mon, 2002-04-01 at 17:27, Bryan Voss wrote: > > On Mon, 2002-04-01 at 17:01, Barry Smoke wrote: > > > We were doing a re-install of our imagecast software on our samba > > > server, and the install deleted the images folder with 3 years worth of > > > images in it. Can we get these back? > > > > The only info I have is for ext2 filesystems. Not sure how applicable it > > is for other filesystems, so YMMV. > > > > 1) Take the system offline ***IMMEDIATELY***. Preferably by just > > shutting it off without even doing a shutdown. The longer it runs, the > > more likely your lost data has been overwritten. Even doing a proper > > shutdown can overwrite some of the data. > > > > 2) Remove the drive/drives and hook them up to another system. > > > > 3) Mount the filesystem(s) read-only. > > > > 4) Download and compile The Coroner's Toolkit, which contains a couple > > of utilities you will need: unrm and lazarus. You can get TCT at: > > http://www.fish.com/tct/ . You may also want to get TCTUTILs from > > http://www.cerias.purdue.edu/homes/carrier/forensics/ to get a nicer > > interface for TCT. > > > > 5) Read http://www.fish.com/tct/help-recovering-file for a walkthrough. > > > > I did this a few years ago and it works, but it will probably take you > > many many hours to do a recovery and then it will probably be only > > partial. Some files will probably already be partially overwritten, so > > you can expect some corrupted images and other problems. As Nathan said, > > backups are the only good recovery path, but it's obviously a little > > late for that now. > > > > Also note the things you find that that can be partially recovered. An > > eye opener from a security standpoint. You'll probably find files dating > > back to the time that filesystem was put into use. > > > > > > -- > > \\// > > Bryan Voss > > bvoss@vosswerx.com > > PGP Key: http://www.vosswerx.com/bvoss/pgpkey.txt > > > > _______________________________________________ > > Lrlug-discuss mailing list > > Lrlug-discuss@lrlug.org > > http://lrlug.org/cgi-bin/mailman/listinfo/lrlug-discuss