Linux Undelete?

RaptorX · 08-29-2009, 02:48 PM

as far as I can read almost everywhere if you use the "rm" command in linux you simply cannot retrieve the files anymore...

But today i read this (talking about chattr +u):

Quote:

If a file has the u (undelete) attribute set, then when it is deleted, its contents can still be retrieved (undeleted).

so... two questions:

1) Why isnt that the default behavior?

2) What would happen if you chattr +u your system... any stupid problem I am not aware of?

Brian1 · 08-29-2009, 04:11 PM

I was thinking the u option does not apply to current ext2 and ext3 filesystems. Only worked on the orginal ext filesystem and no like rieser or others.

Brian

PTrenholme · 08-29-2009, 05:19 PM

From the man chattr output:

Code:

BUGS AND LIMITATIONS
       The  ‘c’,  ’s’,   and  ‘u’ attributes are not honored by the ext2 and ext3 filesystems as
       implemented in the current mainline Linux kernels.    These attributes may be implemented
       in future versions of the ext2 and ext3 filesystems.

Brian1 · 08-29-2009, 08:18 PM

I thought i read long long ago. i could not remember where. I tell you I need to use the man command more often. Thanks

Brian

RaptorX · 09-03-2009, 11:56 AM

The thing is that i got in to some troubles by deleting something by mistake, and there is no recovery... I think at least if it is not a default option there should be a "failsafe" way to know that your files are still there...

Quakeboy02 · 09-03-2009, 12:06 PM

If it's a big concern to you, then you should look into creating an alias to move the files you're "deleting" to the trash can. Easier still is to use the GUI to delete, as that puts deleted files in the trash.

H_TeXMeX_H · 09-03-2009, 01:03 PM

Actually even with all of the above I'm quite positive you can still retrieve the files using photorec and foremost.

I have no need for such a feature. In fact, in rox-filer I set it to delete as soon as I hit delete with no prompts whatsoever, and I have never delete anything I didn't mean to.

RaptorX · 09-03-2009, 01:30 PM

I was not aware of that product.

and actually what i read was that when i file is deleted the linux system writes in those inodes first... so basically the place where your files were get soon overwritten... then that is not true?

Quote:

and I have never delete anything I didn't mean to.

I guess thats because you use GUI a lot... I just used a "find -exec rm" that found exactly what i wanted.... plus a folder that was not supposed to be deleted... and voila.

H_TeXMeX_H · 09-03-2009, 01:52 PM

Quote:

Originally Posted by RaptorX

I was not aware of that product.

and actually what i read was that when i file is deleted the linux system writes in those inodes first... so basically the place where your files were get soon overwritten... then that is not true?

Well, they can get overwritten, but they may not, especially if you act ASAP.

Quote:

I guess thats because you use GUI a lot... I just used a "find -exec rm" that found exactly what i wanted.... plus a folder that was not supposed to be deleted... and voila.

Well in that case ... yes

RaptorX · 09-03-2009, 01:56 PM

thats why i was actually asking since I saw that you actually have the attribute "u" to allow undelete natively in the fs but as they explained me it is not working at the moment, but soon it will, Im glad about that .

lumak · 09-03-2009, 02:40 PM

if you really are paranoid about this, you can make a directory somewhere (e.g. /var/global_recycle) then write a script to go in /usr/local/bin that will replace the rm command with one that will move everything to the recycle bin of a user or system wide. Then you could clean it up with an extra flag of 'rm --empty'

EXAMPLE SCRIPT ONLY
DO NOT USE AS IS

Code:

#!/bin/sh

if [ $1 == "--empty" ]; then
  rm -rf $HOME/trash/*
else
  mv $@ $HOME/trash
fi

of course you would need some kind of database file (e.g. /var/log/recycledb) OR have a loop that runs through each file and places it in the trash with a path relative to the root system so that you know where the files go. Additionally you would want to put checks in there to avoid overwriting file names by incrementing the name AND checking for names that are too long so that the increment doesn't extend the end.

you could even make a global config file to go in /etc/recycle.conf

OR you could just get in the habit of not removing anything and just moving it all to a directory your self and delete it when you get around to it.

Enjoy making your system "Oops I didn't make a back up" proof. Me personally, I feel I deserve it when I do something stupid. Then I learn from it.

I guess this would actually be a nice feature for a system administrator when answering the question "where did my file go?!"...

RaptorX · 09-08-2009, 04:32 PM

Quote:

Enjoy making your system "Oops I didn't make a back up" proof. Me personally, I feel I deserve it when I do something stupid. Then I learn from it.

I guess this would actually be a nice feature for a system administrator when answering the question "where did my file go?!"...

I guess you are right...

The script that you proposed is actually a good practice for me since I am learning bash scripting. I will try to do something similar, just for fun though, since I guess people is right by saying that just being a little bit more careful you can avoid some things.

The problem comes when newbies like me start messing with the system (and writing shell scripts) that end up making some "magic" in the system files and then not being able to recover them.

As far as the recovery programs go, I was brain washed from windows with the idea that those only existed for windows, until now I didnt know there were programs for linux as well. As far as I could tell in linux (and mac) when you delete a file "is gone".

Thanks guys for the replays, one learns something new every day isnt that true?