14

I accidentally deleted /home with sudo rm -rf.

I tried to restore it with testdisk, but because Ubuntu is from Wubi, it cannot list the filesystem and I don't know another way to do this.

How could I restore my data? It's important.

I'm using 10.10 on Wubi

1

4 Answers 4

8

Unfortunately, whether in wubi or standard ubuntu, when you remove things with rm -rf, its nigh impossible to recover. There are tools out there, but their effectiveness is relatively low when you've used rm -rf

EDIT
One of the tools explained in a comment to this was photorec. It may help to recover data, but it won't restore filenames or paths, so you'll have to figure out what is what on your own. Also, it may not work because you're using Wubi and not a direct-to-drive installation.

2
  • 2
    Photorec was able to recover more than 75% of the data for me (after rm -rf). It's not suitable for recovering a whole partition, but if you want to save a few very important files, this is the way to go (it doesn't recover the filenames, so it takes a while to find the right file).
    – arrange
    Jul 11, 2011 at 17:42
  • @arrange put an emphasis on "few". They deleted the entire /home/ dir structure, according to their message. It's quite possible, then, that the section the /home/ area was on is in fact screwed up beyond repair or recovery. Also note this is wubi so not everything works.
    – Thomas Ward
    Jul 11, 2011 at 17:45
7

It should be possible using photorec... e.g. on my wubi install I did the following:

sudo apt-get install testdisk
sudo photorec /dev/loop0
[proceed]
[none] (partition type table)
P ext4 [search]
[ext2/ext3]
[free] (or I guess you could use [whole])

Then select some place to recover other than the wubi install (I assume you'd run this from a live CD, so select the local hard drive... I used /host/ubuntu )

Then hit Y to select and it runs.

Then check results. Here's some terminal output

bcbc@ubuntu:~$ sudo photorec /dev/loop0
PhotoRec 6.11, Data Recovery Utility, April 2009
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org
PhotoRec exited normally.
bcbc@ubuntu:~$ ls /host/ubuntu
disks    recup_dir.1  recup_dir.3  recup_dir.5      Ubuntu.ico          winboot
install  recup_dir.2  recup_dir.4  tedwireless.txt  uninstall-wubi.exe
bcbc@ubuntu:~$ cd /host/ubuntu/recup_dir.1/
bcbc@ubuntu:/host/ubuntu/recup_dir.1$ ls
f0270448.txt  f1666616.txt  f1668496.txt  f1791600.txt  f2403160.txt
f0270472.txt  f1666624.txt  f1668528.txt  f1791608.txt  f2403176.txt
f0270488.txt  f1666632.txt  f1668560.txt  f1791616.txt  f2403208.txt
...

If you're running from a live cd, first mount your windows host and then the root.disk:

sudo mkdir -p /media/win
sudo mount /dev/sda1 /media/win #change /dev/sda1 for your own partition
sudo mount -o loop /media/win/ubuntu/disks/root.disk /mnt

Then you can proceed selecting the appropriate loop device.

4
  • Hmm... thanks for this, I will try. What about files recovered by photorec, when i tried first time i received a few image files and a lot of .txt, but what about .php or .css or .html? Does the photorec recover them?
    – Shogun
    Jul 14, 2011 at 12:51
  • According to cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec it recovers .php and .html, but .css is not listed. You should be able to target specific types... see cgsecurity.org/wiki/… if you want to narrow down the results.
    – bcbc
    Jul 14, 2011 at 14:01
  • bcbc - thanks, this is right way to go, it recovered a lot of files, going to check them all )) this is better than nothing. I checked your answer as solution ;)
    – Shogun
    Jul 14, 2011 at 15:21
  • Good luck. Let us know how it goes
    – bcbc
    Jul 14, 2011 at 20:04
1

There are two main approaches to recovering data. The first is file carving which attempts to identify the start and end of files and extract them. This is very good for certain types of files, but you lose the file names and file times. It is particularly good for jpeg images.

The second approach depends very much on the file system. You are probably using ext3 or ext4. If you are using ext3, then sleuthkit should work. However, I believe that sleuthkit doesn't yet handle ext4. If your file system is ext3, try:

sudo apt-get install sleuthkit

and run

fls -r <device name of your home directory>

e.g.

fls -r /dev/sda1

(I haven't used WUBI so I don't know where your home partition might be.)

This will show you the file names which may be recoverable. If they are recoverable, then icat can be used to recover them.

4
  • Wubi doesnt use a partition. Wubi is installed inside of Windows, and runs off of a virtual image file which acts like the hard drive containing all the data. It does not actually sit on the drive as its own partition. Subsequently, as the partition does not exist for the Linux OS, your above-stated method probably will not work
    – Thomas Ward
    Jul 12, 2011 at 13:02
  • Yep, i tried this method, also with testdisk and photorec but nothing of this worked... My mind goes crazy now. :(
    – Shogun
    Jul 12, 2011 at 17:36
  • @Shogun there's really no other methods left for you to try, then. Because 99.99% of the time removing anything via terminal even with just rm is irrecoverable. Unfortunately, there's no solution to your issue, since neither worked (by the way I DID mention recovery would be almost impossible in my answer).
    – Thomas Ward
    Jul 12, 2011 at 18:33
  • OK. Thanks All for answers, Going to buy soap and a rope... =))
    – Shogun
    Jul 12, 2011 at 20:53
0

May be you can try my tool - http://freshmeat.net/projects/extcarve "extcarve is a ext2/ext3/ext4 file recovery and semantic file carving tool. It can recover a range of file formats, including PNG, JPG, GIF, PDF, C/C++ programs, PHP, and HTML"

1
  • Thanks, but I already done with this using photorec.
    – Shogun
    Jul 17, 2011 at 22:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .