Re: [Evolution] Accidental deletion of local folder

[Leonard Evens <len math northwestern edu>]

On Fri, 2014-04-04 at 13:46 +0100, G.W. Haywood wrote:
> Hi there,
>
> On Fri, 4 Apr 2014,  Leonard Evens wrote:
>
> > I accidentally chose to expunge a local folder ...
>
> Ooops.  But we've all done things like that.
>
> You do have regular (at least nightly) backups running, don't you?
>
> > Is there some way to recover what was in that folder if I don't
> > close evolution first?

Thanks for the help, but I didn't have anything in that folder which
would merit such extreme measures.   I will just live with the loss.

> It probably makes little difference whether or not you close Evolution.
>
> It matters a lot how badly you want the data back, because it's tricky.
>
> Bearing in mind that you can read this message on any computer at all,
> you may possibly improve your chances if you simply pull out the power
> lead that supplies your computer.  Now.
>
> You're reading the rest of this on a friend's computer, or down at the
> local library, right?
>
> Now you need to 'mount' your hard disc (assuming that it is in fact a
> hard disc on which your Evolution mail store resides) READ ONLY and do
> some work on forensic-style data recovery methods.
>
> If you think you can wait a while for the data, then you could make an
> "image copy" of your hard disc on some other storage medium.  I mostly
> use another hard disc.  You can then carry on using the original disc
> in your computer knowing that whatever is recoverable is on the image.
>
> This kind of data recovery is possible because when you delete data on
> a computer, usually all that happens is that a kind of pointer to the
> on-disc copy of the data is destroyed -- the data itself is not in
> fact destroyed.  It's just that the operating system (deliberately)
> forgets how to access it.  With a good knowledge of an admittedly very
> complex data storage system, you have a good chance of recovering the
> data almost complete IF THE DATA HAS NOT ALREADY BEEN OVERWRITTEN.
> That's why I suggest that if you really do badly want the data back
> you should disconnect your computer from the electricity, pronto.
>
> Not easy to do the recovery, and you might not get every last little
> bit of the data, but quite feasible.  There are services you can pay
> to do it for you.  You can probably register on a forum somewhere and
> ask questions about it, and people who rebuild ext4 filesystems before
> breakfast will be able to answer them.  I'm such a person, but I won't
> do more than what I've done here without a large payment of money and
> you can get enough information elsewhere to do it yourself for free.
>
> By the way I'm not suggesting that you're using an ext4 filesystem, it
> just happens that the last time I recovered some lost data it was on a
> Linux box with an ext4 filesystem.  Each operating system has a set of
> filesystem types which it can use.  Windows for example will generally
> use NTFS thesedays.
>
> > I hope there is some place where expunged messages are put.
>
> There is no such place unless you are doing something funky with your
> filesystem -- and from your question I am sure that you are not.
>
> Finally it may be possible to recover the data even _after_ it's been
> overwritten, but then we're into the realms of 'real' forensics such
> as used by law enforcement authorities and I feel sure you won't want
> to go that far.
>
> --
>
> 73,
> Ged.
> _______________________________________________
> evolution-list mailing list
> evolution-list gnome org
> To change your list options or unsubscribe, visit ...
> https://mail.gnome.org/mailman/listinfo/evolution-list

-- 
Leonard Evens len math northwestern edu
Professor Emeritus, Department of Mathematics, Northwestern University