Re: [Evolution] Accidental deletion of local folder

["G.W. Haywood" <evolution jubileegroup co uk>]

Hi there,

On Fri, 4 Apr 2014,  Leonard Evens wrote:

> I accidentally chose to expunge a local folder ...

Ooops.  But we've all done things like that.

You do have regular (at least nightly) backups running, don't you?

> Is there some way to recover what was in that folder if I don't
> close evolution first?

It probably makes little difference whether or not you close Evolution.

It matters a lot how badly you want the data back, because it's tricky.

Bearing in mind that you can read this message on any computer at all,
you may possibly improve your chances if you simply pull out the power
lead that supplies your computer.  Now.

You're reading the rest of this on a friend's computer, or down at the
local library, right?

Now you need to 'mount' your hard disc (assuming that it is in fact a
hard disc on which your Evolution mail store resides) READ ONLY and do
some work on forensic-style data recovery methods.

If you think you can wait a while for the data, then you could make an
"image copy" of your hard disc on some other storage medium.  I mostly
use another hard disc.  You can then carry on using the original disc
in your computer knowing that whatever is recoverable is on the image.

This kind of data recovery is possible because when you delete data on
a computer, usually all that happens is that a kind of pointer to the
on-disc copy of the data is destroyed -- the data itself is not in
fact destroyed.  It's just that the operating system (deliberately)
forgets how to access it.  With a good knowledge of an admittedly very
complex data storage system, you have a good chance of recovering the
data almost complete IF THE DATA HAS NOT ALREADY BEEN OVERWRITTEN.
That's why I suggest that if you really do badly want the data back
you should disconnect your computer from the electricity, pronto.

Not easy to do the recovery, and you might not get every last little
bit of the data, but quite feasible.  There are services you can pay
to do it for you.  You can probably register on a forum somewhere and
ask questions about it, and people who rebuild ext4 filesystems before
breakfast will be able to answer them.  I'm such a person, but I won't
do more than what I've done here without a large payment of money and
you can get enough information elsewhere to do it yourself for free.

By the way I'm not suggesting that you're using an ext4 filesystem, it
just happens that the last time I recovered some lost data it was on a
Linux box with an ext4 filesystem.  Each operating system has a set of
filesystem types which it can use.  Windows for example will generally
use NTFS thesedays.

> I hope there is some place where expunged messages are put.

There is no such place unless you are doing something funky with your
filesystem -- and from your question I am sure that you are not.

Finally it may be possible to recover the data even _after_ it's been
overwritten, but then we're into the realms of 'real' forensics such
as used by law enforcement authorities and I feel sure you won't want
to go that far.

--

73,
Ged.