Barry Smoke
2002-Jun-04 07:55 UTC
[Fwd: [Samba] Re: [K12OSN] Re: [Lrlug-discuss]emergency....file/directory recovery]
I sent to samba list, with the wrong e-mail account, so it never made it... Any help with this is appreciated. Barry Smoke District Network Administrator Bryant Public Schools -----Forwarded Message-----> From: Steve Langasek <vorlon@dodds.net> > To: k12osn@redhat.com > Cc: lrlug-discuss@lrlug.org, samba@lists.samba.org > Subject: [Samba] Re: [K12OSN] Re: [Lrlug-discuss]emergency....file/directory recovery > Date: 03 Jun 2002 17:03:27 -0500 > > On Mon, Jun 03, 2002 at 04:55:44PM -0500, Barry Smoke wrote: > > We have had another instance of this..... > > since I am forwarding to other lists, "this" involves a lost file, due > > to accidental deletion. > > > in this case, we had a backup, but from the backup time, till deletion > > time, a lot of data had been lost. > > > So, we have not enough disk space to do hourly backups, > > novell allowed recovery of a lost file like this, > > so: > > > is there a filesystem that we need to switch to, that is still linux > > compatible that has file recovery like this?.....journaled...? > > > Is there an application level program, that keeps stuff that has been > > deleted?....besides backup, and backup often!? > > > This is mostly a samba issue, for windows users.... > > maybe there should be a samba plug-in, or a purge type structure built > > in to samba-core. > > > This appears to be a real problem for us. > > > I think this will plague other districts/organizations/businesses in the > > decision to move to linux, where using samba is possible, but at what > > cost to file integrity...(maybe integrity is not the right word...) > > As I'm sure the people on the Samba list (whom you've cc:ed) will be happy > to tell you, there is a "vfs trashcan" implementation available for Samba > 2.2 and above. I believe it's part of the main Samba source in the Samba > 3.0 CVS and will soon be built by default there; I'm not exactly sure what > you have to do to get this for Samba 2.2.x, and will defer to Samba list > denizens. > > Steve Langasek > postmodern programmer > > > > On Mon, 2002-04-01 at 17:27, Bryan Voss wrote: > > > On Mon, 2002-04-01 at 17:01, Barry Smoke wrote: > > > > We were doing a re-install of our imagecast software on our samba > > > > server, and the install deleted the images folder with 3 years worth of > > > > images in it. Can we get these back? > > > > > > The only info I have is for ext2 filesystems. Not sure how applicable it > > > is for other filesystems, so YMMV. > > > > > > 1) Take the system offline ***IMMEDIATELY***. Preferably by just > > > shutting it off without even doing a shutdown. The longer it runs, the > > > more likely your lost data has been overwritten. Even doing a proper > > > shutdown can overwrite some of the data. > > > > > > 2) Remove the drive/drives and hook them up to another system. > > > > > > 3) Mount the filesystem(s) read-only. > > > > > > 4) Download and compile The Coroner's Toolkit, which contains a couple > > > of utilities you will need: unrm and lazarus. You can get TCT at: > > > http://www.fish.com/tct/ . You may also want to get TCTUTILs from > > > http://www.cerias.purdue.edu/homes/carrier/forensics/ to get a nicer > > > interface for TCT. > > > > > > 5) Read http://www.fish.com/tct/help-recovering-file for a walkthrough. > > > > > > I did this a few years ago and it works, but it will probably take you > > > many many hours to do a recovery and then it will probably be only > > > partial. Some files will probably already be partially overwritten, so > > > you can expect some corrupted images and other problems. As Nathan said, > > > backups are the only good recovery path, but it's obviously a little > > > late for that now. > > > > > > Also note the things you find that that can be partially recovered. An > > > eye opener from a security standpoint. You'll probably find files dating > > > back to the time that filesystem was put into use. > > > > > > > > > -- > > > \\// > > > Bryan Voss > > > bvoss@vosswerx.com > > > PGP Key: http://www.vosswerx.com/bvoss/pgpkey.txt > > > > > > _______________________________________________ > > > Lrlug-discuss mailing list > > > Lrlug-discuss@lrlug.org > > > http://lrlug.org/cgi-bin/mailman/listinfo/lrlug-discuss > > > > > > > > > > > > _______________________________________________ > > K12OSN mailing list > > K12OSN@redhat.com > > https://listman.redhat.com/mailman/listinfo/k12osn > > For more info see <http://www.k12os.org> > > -- > To unsubscribe from this list go to the following URL and read the > instructions: http://lists.samba.org/mailman/listinfo/samba
Chris Tooley
2002-Jun-04 12:30 UTC
[Fwd: [Samba] Re: [K12OSN] Re: [Lrlug-discuss]emergency....file/directory recovery]
The "Recycle Bin" option in the smb.conf allows you to create a "Salvage" area like Netware has. This is a really wonderful feature that I've been using for several releases and happy to see in the latest release of Samba. It works pretty well, and can grow extremely fast. It's better than Netware's Salvage though as it does revisioning. And since it's a standard directory instead of a "special place" it's actually easier for me to browse the files to recover the right ones. Chris Tooley On Tue, 2002-06-04 at 09:49, Barry Smoke wrote:> I sent to samba list, with the wrong e-mail account, so it never made > it... > > Any help with this is appreciated. > > Barry Smoke > District Network Administrator > Bryant Public Schools > > -----Forwarded Message----- > > > > From: Steve Langasek <vorlon@dodds.net> > > To: k12osn@redhat.com > > Cc: lrlug-discuss@lrlug.org, samba@lists.samba.org > > Subject: [Samba] Re: [K12OSN] Re: [Lrlug-discuss]emergency....file/directory recovery > > Date: 03 Jun 2002 17:03:27 -0500 > > > > On Mon, Jun 03, 2002 at 04:55:44PM -0500, Barry Smoke wrote: > > > We have had another instance of this..... > > > since I am forwarding to other lists, "this" involves a lost file, due > > > to accidental deletion. > > > > > in this case, we had a backup, but from the backup time, till deletion > > > time, a lot of data had been lost. > > > > > So, we have not enough disk space to do hourly backups, > > > novell allowed recovery of a lost file like this, > > > so: > > > > > is there a filesystem that we need to switch to, that is still linux > > > compatible that has file recovery like this?.....journaled...? > > > > > Is there an application level program, that keeps stuff that has been > > > deleted?....besides backup, and backup often!? > > > > > This is mostly a samba issue, for windows users.... > > > maybe there should be a samba plug-in, or a purge type structure built > > > in to samba-core. > > > > > This appears to be a real problem for us. > > > > > I think this will plague other districts/organizations/businesses in the > > > decision to move to linux, where using samba is possible, but at what > > > cost to file integrity...(maybe integrity is not the right word...) > > > > As I'm sure the people on the Samba list (whom you've cc:ed) will be happy > > to tell you, there is a "vfs trashcan" implementation available for Samba > > 2.2 and above. I believe it's part of the main Samba source in the Samba > > 3.0 CVS and will soon be built by default there; I'm not exactly sure what > > you have to do to get this for Samba 2.2.x, and will defer to Samba list > > denizens. > > > > Steve Langasek > > postmodern programmer > > > > > > > On Mon, 2002-04-01 at 17:27, Bryan Voss wrote: > > > > On Mon, 2002-04-01 at 17:01, Barry Smoke wrote: > > > > > We were doing a re-install of our imagecast software on our samba > > > > > server, and the install deleted the images folder with 3 years worth of > > > > > images in it. Can we get these back? > > > > > > > > The only info I have is for ext2 filesystems. Not sure how applicable it > > > > is for other filesystems, so YMMV. > > > > > > > > 1) Take the system offline ***IMMEDIATELY***. Preferably by just > > > > shutting it off without even doing a shutdown. The longer it runs, the > > > > more likely your lost data has been overwritten. Even doing a proper > > > > shutdown can overwrite some of the data. > > > > > > > > 2) Remove the drive/drives and hook them up to another system. > > > > > > > > 3) Mount the filesystem(s) read-only. > > > > > > > > 4) Download and compile The Coroner's Toolkit, which contains a couple > > > > of utilities you will need: unrm and lazarus. You can get TCT at: > > > > http://www.fish.com/tct/ . You may also want to get TCTUTILs from > > > > http://www.cerias.purdue.edu/homes/carrier/forensics/ to get a nicer > > > > interface for TCT. > > > > > > > > 5) Read http://www.fish.com/tct/help-recovering-file for a walkthrough. > > > > > > > > I did this a few years ago and it works, but it will probably take you > > > > many many hours to do a recovery and then it will probably be only > > > > partial. Some files will probably already be partially overwritten, so > > > > you can expect some corrupted images and other problems. As Nathan said, > > > > backups are the only good recovery path, but it's obviously a little > > > > late for that now. > > > > > > > > Also note the things you find that that can be partially recovered. An > > > > eye opener from a security standpoint. You'll probably find files dating > > > > back to the time that filesystem was put into use. > > > > > > > > > > > > -- > > > > \\// > > > > Bryan Voss > > > > bvoss@vosswerx.com > > > > PGP Key: http://www.vosswerx.com/bvoss/pgpkey.txt > > > > > > > > _______________________________________________ > > > > Lrlug-discuss mailing list > > > > Lrlug-discuss@lrlug.org > > > > http://lrlug.org/cgi-bin/mailman/listinfo/lrlug-discuss > > > > > > > > > > > > > > > > > > _______________________________________________ > > > K12OSN mailing list > > > K12OSN@redhat.com > > > https://listman.redhat.com/mailman/listinfo/k12osn > > > For more info see <http://www.k12os.org> > > > > -- > > To unsubscribe from this list go to the following URL and read the > > instructions: http://lists.samba.org/mailman/listinfo/samba > > > > -- > To unsubscribe from this list go to the following URL and read the > instructions: http://lists.samba.org/mailman/listinfo/samba