HELP - How can I recover deleted file?

This is a discussion on HELP - How can I recover deleted file? within the Linux Programming forums, part of the Platform Specific Boards category; Hi, I made a serious mistake, typed a space before '*" accidently when using the "rm" comman - the entire ...

  1. #1
    Registered User
    Join Date
    Sep 2003
    Posts
    30

    HELP - How can I recover deleted file?

    Hi,
    I made a serious mistake, typed a space before '*" accidently when using the "rm" comman - the entire directory got deleted - lost some really important files. - 6 months work!!

    Please if anyone knows anyway to recover the files I'd be incredibly thankful.

    I am running RedHat 7.2 - (ext3)

    I looked through google and found "tct" (http://www.fish.com/security/tct or http://www.porcupine.org/forensics/tct.html) - but I tried this and while "unrm" works (but it only took 15 mins when its meant to take prob hour or so) the output file generated can't be opened. I keep getting I/O error.

    Anyway so is there any other way anyone knows to recover deleted files.

    thanks
    Last edited by brett; 09-25-2003 at 04:23 PM.

  2. #2
    Obsessed with C chrismiceli's Avatar
    Join Date
    Jan 2003
    Posts
    501
    might want to try this if you can, I think it works on ext3 fs's, redhat uses that one I think.

    http://recover.sourceforge.net
    Help populate a c/c++ help irc channel
    server: irc://irc.efnet.net
    channel: #c

  3. #3
    twm
    twm is offline
    root
    Join Date
    Sep 2003
    Posts
    232
    >Please if anyone knows anyway to recover the files I'd be incredibly thankful.
    You can't. The UNIX filesystem uses a free list of disk blocks that aren't in use. When you remove a file, the directory entry is removed and the inode is added to the free list of inodes (if there aren't any links to the file) and the datablocks to the free list. Since UNIX is a multitasking system, by the time you start wanting the file back, somebody else is probably using the blocks you told the system you didn't need anymore. So...if you don't have backups, you have my condolences.

    p.s. Be more careful next time. For example, create an alias or remember to use the -i option to rm. That way you'll be prompted before anything is actually removed. It's a nice hedge against disaster that I highly recommend. Say you have that alias:

    alias srm 'rm -i \!*'

    If you really really want to snuff out everything, you can pipe through the yes program that will answer the constant prompts:

    % yes | del *
    The information given in this message is known to work on FreeBSD 4.8 STABLE.
    *The above statement is false if I was too lazy to test it.*
    Please take note that I am not a technical writer, nor do I care to become one.
    If someone finds a mistake, gleaming error or typo, do me a favor...bite me.
    Don't assume that I'm ever entirely serious or entirely joking.

  4. #4
    Registered User
    Join Date
    Aug 2003
    Posts
    470
    If it was a text files you might be able to get some data back by looking at data in dev/hda1(or the device you deleted the file from) You will probably have to use some combination of dd to do this.

  5. #5
    Registered User
    Join Date
    Sep 2003
    Posts
    3
    You could also have an alias that will move your "rm" arguments into /tmp or any directory that you may want to use as your recycle bin.

    But don't fotget to clean this directory sometimes. I recomend a cronjob that will archive your bin every day and another one that will delete archives older than a certain amount of days/weeks.

    You could also have a cronjob that make a backup of all your files every day/week so you could recover from that kind of mistake.

    A good habit is to make backup of your work or at least use some tools to do it for you...

    Cheers,
    Twisgabak

  6. #6
    Registered User
    Join Date
    Sep 2003
    Posts
    224
    I remember the time when I decided to delete the folder that held my Windows partition. I hadn't realized that the partition was still mounted. I hit Cntrl + C as soon as I realized what was happening. Everything seemed to be fine when I logged onto Windows because I had originally hibernated the computer (everything was reloaded from the hard drive). When I restarted from a fresh boot, I got a message saying ntoskrnl was missing!

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. opening empty file causes access violation
    By trevordunstan in forum C Programming
    Replies: 10
    Last Post: 10-21-2008, 11:19 PM
  2. Encryption program
    By zeiffelz in forum C Programming
    Replies: 1
    Last Post: 06-15-2005, 03:39 AM
  3. Making a LIB file from a DEF file for a DLL
    By JMPACS in forum C++ Programming
    Replies: 0
    Last Post: 08-02-2003, 08:19 PM
  4. System
    By drdroid in forum C++ Programming
    Replies: 3
    Last Post: 06-28-2002, 10:12 PM
  5. Need a suggestion on a school project..
    By Screwz Luse in forum C Programming
    Replies: 5
    Last Post: 11-27-2001, 01:58 AM

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21