Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

it seems I've accidentally deleted some files from a network drive (Western Digital NAS with proprietary OS, but probably Linux; used by 3 PCs with Windows XP and Windows 7).

Is there any way to revover the fiels?

Or at least, is there a way to see when and from which client/process the deletion was done? I cannot remember that I deleted a file, so at least I would like to know what happened.

share|improve this question
    
Well this is the reason to backup your data and never to touch your backups. If it's not RAID, power off your NAS, take the drive out, put it in a computer and let a file recovery program run on the drive. That might work, if the blocks aren't overwritten already.. –  Jochem Kuijpers Feb 24 '13 at 23:54

2 Answers 2

You need block-level access to the hard drive. Since your NAS will most probably not give it to you over the network, this means removing the hard drives and attaching them directly to a computer (use linux and make sure it doesn't write anything!). This should be done ASAP.

Depending on the file system, you may then use appropriate recovery tools. If the file was really important (like $1000 important), get data recovery firm do the work. If it is somewhat important (like hours of your time important), or if you like to learn stuff and don't mind wasting your time, try some recovery tools appropriate for the file system. If there is any kind of RAID, good luck even getting to the file system. If the file system is ext3/ext4, you will need to try to recover data from the journal, as it wipes critical data structures.

Unless your NAS has some very unusual logging, you will not know from where the file was deleted, ever. You may be able to get the deletion date (block-level access required) using data recovery/forensic tools.

share|improve this answer

I doubt there are any tools you can run from your PC which will work on your NAS (unless your NAS is presented as a block device to your OS - this is not typically the case - they tend to use Windows filesharing or equivalent).

If you get "Block Level" access to the device, you may be able to run some recovery, but this is pretty hard, and nothing like a simple undelete or looking through your trash folder.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.