Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I had a server, 2 mirror hard drives ( software raid) CentOS5.

Some one access to my server and delete many files on server. I tested the hard by testdisk but it just find the folders and not it's content. I just has shell access to server.

What's the best recovery tools that offer command line recovery? Can I un-raid the hard drivess and try recovery on one of them? is this a good idea?

share|improve this question
up vote 4 down vote accepted

You should do two things:

  1. Since your server was compromised, you should take it offline immediately and audit how this happened. Once you know this, proceed to step 2.

  2. Restore from a known good backup, and while still offline, fix whatever vulnerability led to your initial compromise. RAID is not a backup, and shouldn't be treated as such. Recovering files with some file-recovery methods is possible, but restoring from backup (especially in light of the fact that you were compromised) is really the only reliable option.

share|improve this answer
the plesk log files shows that some one login by admin user and delete all customers and web sites and backups ( I had backups on same machine) the most important are mysql dbs which I dont have good backup – Ashian Dec 7 '11 at 20:31
@Ashian They're not backups if they were on the same hard disks that you would be restoring to, they're just copies of files. What good are they there? You clearly didn't plan for total server failure, or for a compromise. It sounds like you're in too far over your head to resolve the reason for compromise by yourself. You might want to look at hiring a security consultant to analyze the problem. That is, unless your password is pony1 or something equally weak. Then you were just begging to be brute-forced. – MDMarra Dec 7 '11 at 20:34
+1 !!! -> RAID IS NOT A BACKUP <- !!!! -- You have been taught an important lesson about why you need good, off-site backups which have been carefully verified through restore tests. Sorry you had to learn it the hard/painful way. – voretaq7 Dec 7 '11 at 20:37
@MarkM Password is a random text an contain lower case , upper case and digit, but the hacker can access to it,but I dont know how. – Ashian Dec 7 '11 at 20:52
@Ashian Then you should hire a security consultant. You should contact your customers and let them know that their data has most likely been stolen. You should not put that server back online until you've done the first two. – MDMarra Dec 7 '11 at 20:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.