Thread: HELP - How can I recover deleted file?

Hi,
I made a serious mistake, typed a space before '*" accidently when using the "rm" comman - the entire directory got deleted - lost some really important files. - 6 months work!!

Please if anyone knows anyway to recover the files I'd be incredibly thankful.

I am running RedHat 7.2 - (ext3)

I looked through google and found "tct" (http://www.fish.com/security/tct or http://www.porcupine.org/forensics/tct.html) - but I tried this and while "unrm" works (but it only took 15 mins when its meant to take prob hour or so) the output file generated can't be opened. I keep getting I/O error.

Anyway so is there any other way anyone knows to recover deleted files.

thanks

might want to try this if you can, I think it works on ext3 fs's, redhat uses that one I think.

http://recover.sourceforge.net

>Please if anyone knows anyway to recover the files I'd be incredibly thankful.
You can't. The UNIX filesystem uses a free list of disk blocks that aren't in use. When you remove a file, the directory entry is removed and the inode is added to the free list of inodes (if there aren't any links to the file) and the datablocks to the free list. Since UNIX is a multitasking system, by the time you start wanting the file back, somebody else is probably using the blocks you told the system you didn't need anymore. So...if you don't have backups, you have my condolences.

p.s. Be more careful next time. For example, create an alias or remember to use the -i option to rm. That way you'll be prompted before anything is actually removed. It's a nice hedge against disaster that I highly recommend. Say you have that alias:

alias srm 'rm -i \!*'

If you really really want to snuff out everything, you can pipe through the yes program that will answer the constant prompts:

% yes | del *