Data Recovery For The Very Lazy

Tags

bash, sleuthkit, UNIX

After my friend rm’d a bunch of code yesterday, I offered to help.  I first made a copy of her disk using dd, copying it off of her machine and using ssh to take it to another:

sudo dd if=/dev/sda1 | ssh USER@HOST "dd of=/home/USER/backup.img"

I then grabbed a copy of sleuthkit, and used the fls tool to find the inodes pointing at her old files, and icat to restore them.  I new the files were php code, stored in /var/www so I used grep to select those results from all the files listed by fls.  Using grep, I selected the inode numbers from the output, and piped the results to icat.

for i in `fls -r -d backup.img | grep var/www | grep \.php | grep -o [0-9][0-9]*`

do

icat $i > $i

done

Voila, I had a bunch of files, 6 of which were the missing PHP files!  Super easy, and thank goodness the filesystem was ext2, as ext3 is much harder to recover data from.

rm Is Not Your Friend

Tags

bash, UNIX

This afternoon, about 10 minutes before the end of the day, one of the undergrads working in my lab turned to me and asked what the command to undo an rm command was.  I blinked at her, and told her there was none.  I’m now trying to sift through a disk image dumped from the machine she worked on after typing rm -r * in the wrong terminal.  Now, backups, backups, etc. I know.  But even with regular backups, an rm -r * in your home directory is never fun.  If you want to not experience the joys of watching your files turn to dust, add this to your .bashrc:

alias rm="rm -i"

This won’t save you every time, but it will at least prompt you before you blow away 3 weeks of work.  So don’t ignore the prompt. Please?