Recover deleted files from linux server machine..

Linux and Unix-Like Red Hat
1

Hi,

I am working Linux server machine. Somebody by mistake(or may be knowingly) deleted few folders and files from the machine. How is this possible to recover those files and folders????:confused:

I normally logged in through Putty and winscp only. And don't have any history for putty sessions. So there is high probability that it is deleted from winscp session only.

Please help

Thanks

2

By restoring from backups...

3

Hi Vbe,

Thanks for your reply. But no backup for those files...:(..:wall:

Someone desperately deleting those files.
and one more thing is we are sharing same user name for different teams. and don't have root access also.

So at least, how can i find who has deleted those files..?

Tried with history . didn't worked...:wall:

Thanks for your help..
pamu

4

There are some tools to recover deleted files, but they are filesystem specific, e.g. FAT32, ext2, etc. Unfortunately, without root, you almost certainly cannot use these tools; they require raw access to the disk/partition device, which is seldom granted to unprivileged users.

If such a tool exists for your filesystem and if you are able to attain root, you should unmount that filesystem immediately. Once the data is overwritten with another file, your chances of recovery are practically zero.

Regards,
Alister

1 Like
5

Are you sure they have been removed in the first place?
They could have been moved... or more vicious: renamed...
You should find something in the history files but that means looking at ( and have to be root...) all the users that connected since the last you knew the files present... (In older days I used to crash the system, use fsck, and reboot -n...)

6

Hi vbe,

Yes i am sure somebody from other team has deleted those files and folders.
I may have asked this question of the moving or renaming files but there are 4-5 main directory, lot of sub-directory and each having many files. and this happened second time in today itself. So i am sure about the files are not moved.
Yes. I don't have root access and the same others also don't have so there is very little chance that root user can delete this. That's why i checked only history for our common user.
But as per my knowledge there is high probability that they have deleted all the files from the winscp . So that's the problem.

thanks,
pamu

7

Without root, you can't do anything.

With root, the chances are unlikely since the system has been operating a long time since the files were deleted.

8

Suggest you escalate this problem to the Systems Administrator stating clearly what has happened and what files you want recovered. Ultimately it is the responsibility of the Systems Administrator to backup the system and to ensure isolation of users.
Note: As a non-root user, the fact that you cannot see certain files does not mean that they have been deleted.

This is clearly not HP-UX. So that we can move the post to the correct forum, please post:

uname -a  # Blotting anything confidential with Xs
9

Hi Methyl and Corona688,

Thanks for reply. Sorry for my late reply..

$ uname -a
Linux XX.XX.XX 2.X.XX-XX.19.1.el5 #1 SMP Sun Jul 10 08:43:41 EDT 2011 x86_64 x86_64 x86_64 GNU/Linux

As per my knowledge we don't have any specialized system admin, who dedicated for our server......:(..... So there is no possibility of backup. :frowning:

Any way i already assumed that my data is lost and i can not recover it.:frowning: ...:wall:

From this i have learned that i should take backup by myself.....:slight_smile:

Anyway thanks for your help..