Recovering a wiped hard drive via FreeBSD

Z

zkt72

So some guy went and wiped a Hard drive for our server and all the backups that were kept in an FTP server so I was wondering if anyone knows if we can recover this drive because OVH's(our host) has a recovery mode but it happens to be FreeBSD and while we were using putty to use this we realised it is nothing like what we are accustomed to with the server were we can use like sudo apt-get and such and we can't use something like ddrescue to recover all the data on this Hard Drive, so I was hoping someone would know a way to do this using FreeBSD so we can get this server back up and running on Ubuntu 14.04 and recover all of the important data this guy deleted and get some back ups and then make sure he can't touch the console ever again... Thank god he doesn't touch accounting. Thank you guys in advance and hope someone has the ability to help us so we can get back up on our feet.
 
So the first thing to do is to dismount it to prevent additional writes. Set up a new system to work on it, and only work on an image of the drive.
 
wblock@ said:
So the first thing to do is to dismount it to prevent additional writes. Set up a new system to work on it, and only work on an image of the drive.
Click to expand...
We already unmounted it and our host has a NAS that let's use use FreeBSD to recover the files, but we can't actually setup a new system since this is being done remotely and this guy also deleted all of our backups so we will be keeping backups in home now.
 
What kind of filesystem? I was going to point out sysutils/testdisk (as pkg install testdisk on FreeBSD) as a recovery tool but it looks like it only supports partition operations with UFS and not file level recovery. If it's ZFS it's a whole other story but one where snapshots could save the day.
 
Use ddrescue and / or whatever tools you have available (including paying someone at OVH to do the job for you) to get image(s) of the drive / drives / filesystems in question to file(s). Get those files to you locally. Make a backup of them (on a different physical medium, preferably locked away). Now, experiment on the copy until you have gotten as much data out of it as you can / are happy with for the money spent.

You should also learn: keep backups of important things physically and logically separated, so they can't be destroyed by accidents, incompetence or malice.
 
tingo said:
Use ddrescue and / or whatever tools you have available (including paying someone at OVH to do the job for you) to get image(s) of the drive / drives / filesystems in question to file(s). Get those files to you locally. Make a backup of them (on a different physical medium, preferably locked away). Now, experiment on the copy until you have gotten as much data out of it as you can / are happy with for the money spent.

You should also learn: keep backups of important things physically and logically separated, so they can't be destroyed by accidents, incompetence or malice.
Click to expand...

OVH won't touch our personal stuff and we have to use OVH's rescue mode which requires us to use what we have because rescue mode is mounted in read-only and we can't change how it is mounted but I manage to get a image of the affected disks to get them over to a windows or FreeBSD PC(not sure which I will us yet) and turn the image back into files and scan through them with testdisk and I cannot install anything because the 2 500GB hard drives can't be mounted because they had the files on them but next server has 2 1TB drives in raid 1 enough for a teamspeak and a website, forums and gameservers and such.
 
You must log in or register to reply here.
Back
Top