Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : HELP! I deleted some files on a linux server... Is there a way to get them back?

[invasionmix]

Hi, I accidentally deleted a couple folders & files via FTP. Is there a way I can get them back? It's very urgent, thanks you.

The machine is on redhat 9.0. When I type #mount, it displays:

/dev/hda2 on / type ext3 (rw,usrquota,grpquota)
none on /proc type proc (rw)
usbdevfs on /proc/bus/usb type usbdevfs (rw)
/dev/hda1 on /boot type ext3 (rw)
none on /dev/pts type devpts (rw,gid=5,mode=620)
none on /dev/shm type tmpfs (rw)

I hope the above information helps..if any

Thank you

[eddy2099]

Do you have a backup which you can restore from ?

[RSanders]

grep can acually be used to pull some files off the HDD. But, its like trying to unscramble an egg.

I've seen other utilitys, but IIRC not for ext3. You have a backup right?

[invasionmix]

no backup

[XLHost]

Did you rm -rf / or what did you actually delete? Once a junior admin at my 9-5 did a rm -rf /sbin (he was fired) on our primary mail server, and I had to copy the tar/gzip the /sbin dir off of another box and copy it over. I didnt expect it to work but it did, after some Chmodding.

What did you actually delete? posting the mount isnt helping much.

-Drew

[RSanders]

Being that you did it with FTP, I would assume they are user files.

After you stop beating your head against the wall, contact your host or a offsite company and get a backup routine in place.

[sprintserve]

When CPanel first came out with their jail shell beta, I "smartly" deleted the virtfs directory as I thought it was just a normal directory. Luckily I was testing it on a new unused server In any case, a full restore did the trick.

As in your case, well, unfortunately restoring files is not linux strong point for a reason. Windows ability to restore files is actually a weak link security wise if you are not aware of how they handle deletion.

[RH Robert]

From what I understand about ext3, if a file is deleted, the inode data is removed as well. This means the list of data blocks is lost, so it would be virtually impossible to recover any deleted file. However, you may want to email the admin at http://www.sleuthkit.org as they have had some success recovering ext3 files. I guess it all depends on how important these files are, and if it would be easier to copy them from another system.
If it was ext2, Midnight Commander would do the trick: http://www.ibiblio.org/mc/