I was just watching a movie while suddenly all the files except the hidden ones in my home directory were gone, just as someone issued the command
sudo rm -rf /home/shakir/*
To avoid further data loss, I quickly power off and boot into my Ubuntu live CD to create an image of my /home partition. Here's how to see in which partition is my /home directory:
shakir@herugrim ~ $ cat /proc/partitions major minor #blocks name 8 0 156290904 sda 8 1 21494938 sda1 8 2 8795587 sda2 8 3 2939895 sda3 8 4 1 sda4 8 5 9775521 sda5 8 6 113282316 sda6
From the partition sizes I can tell my /home partition was in the /dev/sda6, and the next step is to really create an image of the partition to safely doing the recovery process without risking of losing more data. /media/usbdisk is where my external usb harddisk is mounted
sudo dd if=/dev/sda6 of=/media/usbdisk/herugrim-sda6-20071010.img
Photorec is part of testdisk package, and this is how to install it in ubuntu;
sudo apt-get update sudo apt-get install testdisk
It's time to actually do run the program
sudo photorec /home/shakir/temp/herugrim-sda6-20071010.img
After going through some options, photorec starts doing it's job.
Photorec stores recovered files in recup_dir.<sequence>/<sequence>.<file extension> in the specified target directory, which is not very useful. Here's a script I wrote to find all the recovered JPEG files and move/rename it accordingly. Almost the same technique can be used for other file formats.
#!/bin/bash
PHOTODIR=/home/shakir/temp/photorec
cd $PHOTODIR
mkdir JPEG
for i in `ls | grep recup`;do
for j in `ls $i/*.jpg`; do
if FILE=`exiv2 $j 2>/dev/null | grep timestamp | awk ‘{ print $4"-"$5 }’ | tr -d ‘:’ | grep 200`; then
cp -v $j "JPEG/"$FILE".jpg"
fi
done
done
6 Comments on this post
Leave a Commentsifu, kalo dah create image cmna nk reverse blk..hehe..cthnye backup 1 partition linux pastu nk extract blk
Comment left on 10.31.2007 by izlan
just tukar *if* ngan *of* ajelah
sudo dd if=/media/usbdisk/herugrim-sda6-20071010.img of=/dev/sda6
Make sure the image file is not any bigger than the partition’s size or it might overwrite your next partition’s data
Comment left on 10.31.2007 by shakir
TemperatureReadEvent,1191036795.878820,2007-09-29 11:33:15,,142,00173b00115eb27a,node6-6lowpan,77.3
TemperatureReadEvent,1191037095.882040,2007-09-29 11:38:15,,148,00173b00115eb27a,node6-6lowpan,77.4
TemperatureReadEvent,1191037395.889310,2007-09-29 11:43:15,,154,00173b00115eb27a,node6-6lowpan,77.5
TemperatureReadEvent,1191037695.932600,2007-09-29 11:48:15,,160,00173b00115eb27a,node6-6lowpan,77.5
kalo ada 4 line ni camne nk extract no yg blakang saje?
kalo cat TemperatureReadEvent.txt | tr “,” ” ” | cut -d ” ” -f9
77.3
77.4
77.5
77.5
kalo nk amik line pertama je cmne?
Comment left on 11.2.2007 by izlan
pipe je ke head..
bla2 | head -n 1
Comment left on 11.3.2007 by shakir
this was very helpful, thanks for the instructions on photorec. Worked like a charm. One thing I found helpful though is instead of the script, you can find all the files you want and copy or move them is in terminal a little bit easier, like this:
find /path/to/music -iname ‘*.mp3′ -exec cp {} /new/directory/ \;
Comment left on 10.17.2009 by miles
Your examples were of much help.
Not even on the official Photorec wiki did I find so clear examples.
I’ll just add something: it is recommended to go to the folder where we want to save the recovered files before we use photorec, i.e:
cd /home/pejeno/my_recovered_files
then
sudo photorec /home/pejeno/myimage.img
Thank you very much for this post.
Comment left on 9.20.2010 by Pejeno