Recover deleted share

[pacco]

If you delete a share in the Lacie Dashboard, would it be possible to recover it with the standalone kernel?

Regards,

Frank

[Jocko]

Hi pacco,

I believe that with xfs fs you can not recover a deleted file. :dry

[fvdw]

the question is if lacie really deletes the associated folder when removing a share.
To be honest I don't know. :dontknow

Just test it and load the standalone kernel you could mount and explore the data partition (sdx2)

[pacco]

the question is if lacie really deletes the associated folder when removing a share.
To be honest I don't know. :dontknow

Just test it and load the standalone kernel you could mount and explore the data partition (sdx2)

Will try next week and let you know.

Thanks!

[pacco]

the question is if lacie really deletes the associated folder when removing a share.
To be honest I don't know. :dontknow

Just test it and load the standalone kernel you could mount and explore the data partition (sdx2)

I have a RAID5 setup. Mounting the RAID is easy. Can only see the files and folders that are not deleted.
But how do I mount the individual drives of this RAID to check the content?

[pacco]

I have a RAID5 setup. Mounting the RAID is easy. Can only see the files and folders that are not deleted.
But how do I mount the individual drives of this RAID to check the content?

Can someone please help me? There might be some important data on the deleted share to recover.

[Mijzelf]

But how do I mount the individual drives of this RAID to check the content?

The question is not applicable. To mount a block device it needs to have a filesystem. A single member of a raid5 system doesn't have a filesystem. The filesystem is put on the whole array, and doesn't 'know' the exposed blockdevice is build of several individual disks.

There might be some important data on the deleted share to recover.

AFAIK your only option is low-level recovery. A program like PhotoRec can search the raw space of the raid array for files, without help of the filesystem. To be able to do that, the file needs be recognizabe by some specific header. Here is a list of supported file types. Further the tool only can find files, not it's meta data. So no filename, no timestamps, ...

[pacco]

But how do I mount the individual drives of this RAID to check the content?

The question is not applicable. To mount a block device it needs to have a filesystem. A single member of a raid5 system doesn't have a filesystem. The filesystem is put on the whole array, and doesn't 'know' the exposed blockdevice is build of several individual disks.

There might be some important data on the deleted share to recover.

AFAIK your only option is low-level recovery. A program like PhotoRec can search the raw space of the raid array for files, without help of the filesystem. To be able to do that, the file needs be recognizabe by some specific header. Here is a list of supported file types. Further the tool only can find files, not it's meta data. So no filename, no timestamps, ...

Thanks Mijzelf.

I am away until next week. Will try this begin next week. Can I use this PhotoRec software from the standalone kernel? What version to use? Linux, kernel 2.6.18 or later i386 or Linux, kernel 2.6.18 or later x86_64. Any tips on how to install it?

[Mijzelf]

Can I use this PhotoRec software from the standalone kernel?

Yes.

What version to use? Linux, kernel 2.6.18 or later i386 or Linux, kernel 2.6.18 or later x86_64.

None of them. They are all compiled for x86/amd64, while your nas runs an Armv5.

Any tips on how to install it?

You know how to install ffp. I suggest you to install it on an usb stick (Jocko gave some pointers), and get it running. Then install uwsiteloader. Use it to add my respository. Then you can install photorec:

Code: Select all

slacker -Ui e2fsprogs util-linux libjpeg zlib testlib\&photorec

(Internet access required)

To run it you have to assemble the array, but not mount it, and then run

Code: Select all

photorec /dev/md0

Make sure that you have room to store the recovered files. Photorec does not 'undelete' them, but copies them elsewhere.

(BTW, it's convenient to enable ssh in ffp. It's a better shell than telnet. Further you can install screen, which gives you the possibility to let a session run without being logged in, and pick it up later. The scan of photorec will take days, I think.)