On 16/10/2017 21:00, Deltonos wrote:
You can try withy any distro that contains Sleuthkit+Autopsy:
https://www.sleuthkit.org/autopsy/
My advise is, if you can, make and image using dd from afected machine to
external HD and work from another dedicated system to recover it (or you
can use and live distro like this one http://www.deftlinux.net/download/)
Regards.
2017-10-16 10:23 GMT-05:00 Richard Owlett <rowl...@cloud85.net>:
It wasn't backed up - will have to follow advice advice I've given others
;/
I've not done file recovery since early days of WinXP.
On the affected machine I'm running Stretch(9.1) with Mate desktop.
The affected folders are on a partition normally mounted by a line in
fstab.
I immediately shut down.
There is another instance of Debian on a separate partition.
Logging in as root I edited fstab commenting out the appropriate line.
I feel the the data is still valid - there is just no appropriate
directory entries for the affected folder and its sub-directories.
Guidance please.
TIA
Hi,
Image the partition or at least mount it ro, then depending on the
file-system and the mime-type of the files you want to recover, you can
try "extundelete" (ext3/4, man page is well documented), "photorec" (in
package "testdisk", not limited to photo/image, provides step-by-step
guidance). As mentioned above if the "easy" way don't work you can
resort to proper forensic tools, but they often have a steep learning curve.
Good luck.
