Recover accidentially deleted data

[IceRabbit]

Hi everyone,

I stupidly shift-deleted an important folder within my homedir (kubuntu 11.10, ext4 w/ journalling), and I want to recover it. I've immediately logged out from the netbook (using an old backup laptop now). So far, I've tried getting a live USB stick working (livecd is not an option, my netbook does not have a cd-drive), since searching pointed me to utils such as scalpel, foremost and photorec that could be used to recover the data. The problem is, I cannot get it to work. Trying to install any of these within a live environment always tells me that the package is not found.

Since I'm running out of ideas on how to do this, I hope someone here can assist me. I'd appreciate any and all help.

Kind regards,
IceRabbit

[SteveRiley]

What if you remove the drive from the netbook, place it in an external USB enclosure, and then attempt recovery with the tools installed on your old backup laptop?

[IceRabbit]

I'd rather not try that, since my laptop is an Asus EeePC 1215B, and this is how to disassemble it. I'm not the most tech-handy guy on the planet, and I fear I'll ruin much more than some data if I try that.

~IceRabbit

[Qqmike]

How-To:
RESCUE Partitions & Data

http://www.kubuntuforums.net/showthr...+Comments+Tips

I wrote that quite awhile ago, haven't looked at it in a long time, but it always worked for me (and for others here) -- PhotoRec. Tips are included in that thread. I've used PhotoRec to recover data in some real tight, critical situations.

[oshunluvr]

I've used UFS Explorer successfully but it's not free.

[IceRabbit]

Success (mostly, I think). I'll try to document exactly how I did the recovery, hoping it will help other people after me. An additional problem was the fact that my homedir was encrypted (I do that with all my laptops, so didn't think about it).

1. I made a liveUSB with kubuntu 11.10 to work on without touching my laptop's hard drive. USB was needed since my netbook doesn't have a CD bay. It should work with a livecd as well. LiveUSB was made on my Win7 partiton using this guide.

2. After booting into the live environment, I had to enable the universe source (K-menu, Applications, System, Package manager, Settings, Configure Software Sources, place a tick at the second item (universe)).

3. Next, I opened a terminal and ran

sudo apt-get update && sudo apt-get install extundelete

4. I ran extundelete with a whole bunch of options. I can't remember exactly, but I'll try to recreate it:

sudo extundelete --restore-all --output-directory /home/media/disk/Recovery_attempt --after [date]

where /home/media/disk/Recovery_attempt was an empty folder on an external hard disk with plenty of free space. Also [date] was the unix date of two days ago, since my files were deleted only one day ago. I got the value for [date] by running

date -d "Apr 3 0:00" +%s

It's at this point that I remembered my disk being encrypted. Apparently, this wasn't a problem for extundelete.

5. To decrypt it, I had to mount the disk using

sudo mkdir /recovery && sudo mount -t ext4 -o ro,noload /dev/sda6 /recovery

. Since I hadn't written down the mount passphrase, I ran

sudo ecryptfs-unwrap-passphrase /recovery/.ecryptfs/username/.ecryptfs/wrapped-passphrase

. Basically, this page helped out boatloads (the supertanker kind).

6. Next I used the previous link, but the "recoverinig your data manually" paragraph, and it worked. I did get the error that my passphrase was possibly wrong, and had to answer "yes" (not "y") for it to work.

7. Copied the recovered data to an external (unencrypted) usb stick. And I'm now trudging through it, since the map structure is shot to hell.

This may sound easy and fast, but it took me the better part of two evenings and a morning to figure it all out. Hopefully someone else can get some assistance from this.

Thanks to everyone who helped out!

~IceRabbit