[Gllug] Undelete...?

[Jason Clifford]

On Thu, 5 Feb 2004, Kristian Davies wrote:

> I had a directory with a couple of files starting with "?blah"
> So like a Burk I deleted them with "rm -fr ?*" ... Don't laugh!
> 
> Well anyway, in that directory was a script I use all the time, which I
> would rather no rewrite.
> 
> Is there a way of getting my file back?
> 
> I realise this is a total newb question, but I find it hard to believe there
> is no way of recovering a file which has not been overwritten.

That's because you are not thinking of your PC as a multi-user system.

True multi-user multitasking systems don't really do undelete as it cannot 
be reliable with lots of users/processes able to write to the disk.

If you are lucky the data will still be on the disk and wont have been 
overwritten. If that's the case you can remount the device read only and 
try some of the methods listed in the Undelete howtos - generally using 
the debugfs tool.

Note that these probably wont work on a journaling filesystem like ext3 
however if you have ext3 you can mount it as ext2 which *might* work.

If you are particularly desperate you can open the filesystem as a file 
and search for some identifying text. A small script may be located solely 
in a single inode in which case you'll be able to copy and paste to 
recover it.

Larger files will almost certainly be spread across the disk making it far 
more challenging to recover them.

Jason Clifford
-- 
UKFSN.ORG		Finance Free Software while you surf the 'net
http://www.ukfsn.org/	   ADSL Broadband from just £23.75 / month 

-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug