• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Need help desperately: deleted a virtual machine with critical data under linux.

S

Starriol

Limp Gawd
Joined
Jan 3, 2006
Messages
191
Hi all,

I'm in a pretty messed-up situation, hope you can give me a hand.
I deleted by accident a folder containing a VMware server virtual machine, that contains most critical information. The host OS is CentOS 5.5, which I believe by default uses Ext3.

I shut down the PC intermediately after noticing this.
Is there any chance of recovering the files? Would they be able to mount to the same or another virtual machine?

I need to get this information somehow, there are no backups.

Which software can I use?

If anyone can help me recover this, you'll get a free book by amazon, you have my word.
I'm THAT desperate.
 
First of all, don't boot the machine.

Connect the drive to another linux machine. DO NOT MOUNT IT. Let's say that the disk you just connected is /dev/sdb (check dmesg to see its name). Make sure you have enough space left on the 2nd machine to contain the entire drive (entire drive, not just space used). Run the following as root:
dd if=/dev/sdb of=/root/diskimage bs=1M conv=noerror,sync

This will dump the entire raw data of the drive to that file, so you can run whatever utility you can think of on that file without affecting the first drive. It will take a few hours.

Now you can run one of the many ext3 undelete programs out there. For example: http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html

Theres a high probability you will be able to get the folder back uncorrupted since you shut down the computer right after you deleted it.
 
Connecting the disk to another Ubuntu system might automatically mount it; you would want to do the dd command before any writes happen to the volume. Perhaps you need a Ubuntu server cd that doesn't include a desktop; likely that would also lack the software which automatically mounts newly inserted hardware.

Either way, just make sure your disk is not written to until after you did the dd raw backup. Not doing so might forfeit your last and only chance for recovery.

About the shutdown: if it was a clean shutdown then you still would have the risk of that file/index to be partially overwritten. The best to do in such a situation, is probably to hit the reset button right away, then power off the system. That said, even if some writes happened, it is likely that they didn't occur at the place where the deleted folder is, but that's ofcourse the risk here: overwriting the existing data and you have no chance for data recovery left.
 
You must log in or register to reply here.
Back
Top