LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 01-20-2007, 03:57 PM   #1
sacoskun
LQ Newbie
 
Registered: Feb 2006
Location: Turkey
Distribution: SuSE SLED 10
Posts: 8

Rep: Reputation: 0
Question How to get back removed files?


Hi there,

I would like to know how to restore my removed files from the bash shell.

For instance;
Code:
$rm fileBoo.txt
How to restore fileBoo.txt? Is this possible?

Thanks,
 
Old 01-20-2007, 04:30 PM   #2
uselpa
Senior Member
 
Registered: Oct 2004
Location: Luxemburg
Distribution: Slackware, OS X
Posts: 1,507

Rep: Reputation: 46
No, it's not possible.
 
Old 01-20-2007, 04:43 PM   #3
Matir
LQ Guru
 
Registered: Nov 2004
Location: San Jose, CA
Distribution: Ubuntu
Posts: 8,507

Rep: Reputation: 124Reputation: 124
It *MAY* be possible, depending on the file system in use. It is, however, a non-trivial task.
 
Old 01-20-2007, 05:21 PM   #4
Electro
LQ Guru
 
Registered: Jan 2002
Posts: 6,042

Rep: Reputation: Disabled
If the filesystem that you are using is EXT2/3, it is possible to get files back. Install or look for e2undel.e

It is possible to recover files from other filesystems, but it is not easy. For ReiserFS, read http://antrix.net/journal/techtalk/r...howto.comments. Next time quadruple check before hitting enter. Other filesystems will have to first use their dump utility and then use their restore utility afterwards. In simpler terms, always backup. If you do not like Linux present filesystems because of the this problem, you can design your filesystem that has undelete and unformat features.

I suggest writing a script so this does not happen. In the script, you can move the file from source to the destination directory that is stored on another hard drive. Yes, you will have to have two hard drives. One for your data and other for temp data storage.
 
Old 01-20-2007, 05:35 PM   #5
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Arch/XFCE
Posts: 17,802

Rep: Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738
files are always recoverable--in any file system--unless you write to the disk after deleting the file.
The question is how hard will the recovery be......

If you lose irreplaceable data, do not write to the disk
 
Old 01-21-2007, 03:58 AM   #6
uselpa
Senior Member
 
Registered: Oct 2004
Location: Luxemburg
Distribution: Slackware, OS X
Posts: 1,507

Rep: Reputation: 46
I find there's a lot of shoulds and mays in e2undels description, and the project hasn't seen any change for nearly 3 years now. Is it reliable, has anybody really used it recently?

Still, I think the best assumption one should make is that those files are not recoverable and that you need to double-check before pressing enter. Also, backups are a most useful thing. Otherwise, I'd suggest a tool like libtrash which implements a Windows-like recycle bin on the file system level.
 
Old 01-21-2007, 04:28 AM   #7
V!NCENT
Member
 
Registered: Dec 2005
Location: The Netherlands
Distribution: Kubuntu 8.10 KDE4
Posts: 208

Rep: Reputation: 30
I don't know if I start a mini thread by asking this (correct me if I do) but why exactly are deleted files so easy to recover in Windows? I also thought deleted files in Linux were deleted for ever.
 
Old 01-21-2007, 04:51 AM   #8
uselpa
Senior Member
 
Registered: Oct 2004
Location: Luxemburg
Distribution: Slackware, OS X
Posts: 1,507

Rep: Reputation: 46
I think there's no difference between Windows and Linux. If you delete a file in a graphical environment (Windows Explorer, Gnome Nautilus, KDE Konqueror), it usually gets moved to some kind of trash bin where you can recover it. It's implemented by the desktop environment, not by the OS.

If you do the same in a CLI, it's deleted forever. But due to the fact that the CLI is used much more often in Linux, it appears to be a Linux flaw - it isn't.

Still, the only reliable way to work against this is 1) backups and 2) implement a trash bin on the file system level, i.e. to think about the problem before it happens and not after it happened.

The file recovery tools have their use but they there's no guarantee that they will work, especially in a typical setup where /var and / are on the same partition, because /var gets written to all the time and, again depending on the file system, this will sooner or later overwrite the deleted file.
 
Old 01-21-2007, 08:33 AM   #9
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Arch/XFCE
Posts: 17,802

Rep: Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738
Well, we've now lost the OP---sadly all too common that we may never know if he/she solved the problem.
I am very interested in learning more about file recovery. Are there forums specifically on the topic?
 
Old 01-21-2007, 10:10 AM   #10
galle
Member
 
Registered: Sep 2003
Location: Bergen, Norway
Distribution: Debian testing
Posts: 69

Rep: Reputation: 16
Quote:
Originally Posted by uselpa
I think there's no difference between Windows and Linux.
(...)
If you do the same in a CLI, it's deleted forever. But due to the fact that the CLI is used much more often in Linux, it appears to be a Linux flaw - it isn't.
I remember using an undelete command in DOS. There you got a list of recently deleted files with partly filenames, and when you filled out the name the file was recovered (sounds like hangman doesn't it, fill in the right name and you win! ). It think I used once or twice, but as far as I can remember it worked fine.
 
Old 01-21-2007, 10:20 AM   #11
LinuxLala
Senior Member
 
Registered: Aug 2003
Location: New Delhi, India
Distribution: Fedora 7
Posts: 1,305

Rep: Reputation: 45
Depending on how the system is set up, a temp text file with name foofile~ would probably be the easiest you'd come to a deleted file.

this is a hidden file and most modern distros keep such a backup.
 
Old 01-21-2007, 01:11 PM   #12
uselpa
Senior Member
 
Registered: Oct 2004
Location: Luxemburg
Distribution: Slackware, OS X
Posts: 1,507

Rep: Reputation: 46
Quote:
Originally Posted by galle
I remember using an undelete command in DOS. There you got a list of recently deleted files with partly filenames, and when you filled out the name the file was recovered
Yes, as of MSDOS 5. I haven't used Windows recently, but I don't think that it still works.
 
Old 01-21-2007, 03:07 PM   #13
Electro
LQ Guru
 
Registered: Jan 2002
Posts: 6,042

Rep: Reputation: Disabled
FAT12, 16 and FAT32 are the easiest to undelete files because they replace the first letter of the filename to ?. Since this is illegal, it does not show and the space that this file is taken up is marked to be over write or unused.

Linux filesystems are different because the file name is erased completely off the list. In order to find the file, you will have to search the whole entire partition. Utilities will go by inodes, but finding the correct inodes is like finding special needles in a bunch of needles.


Quote:
Originally Posted by LinuxLala
Depending on how the system is set up, a temp text file with name foofile~ would probably be the easiest you'd come to a deleted file.

this is a hidden file and most modern distros keep such a backup.
All Linux distributions can not undelete files and no they do not keep backups. Yes, finding deleted text files are a little easier, but it is still time consuming.
 
Old 01-21-2007, 03:20 PM   #14
LinuxLala
Senior Member
 
Registered: Aug 2003
Location: New Delhi, India
Distribution: Fedora 7
Posts: 1,305

Rep: Reputation: 45
Electro, I've seen backup files in both ubuntu and fedora. maybe I was misunderstood.

I didn't say the backup file is created when you delete a file. I'm just saying that there is one.

In my experience, all text files, as soon as I edit them create a name~ file without the latest changes.

Last edited by LinuxLala; 01-21-2007 at 03:22 PM.
 
Old 01-21-2007, 03:23 PM   #15
uselpa
Senior Member
 
Registered: Oct 2004
Location: Luxemburg
Distribution: Slackware, OS X
Posts: 1,507

Rep: Reputation: 46
Quote:
Originally Posted by LinuxLala
In my experience, all text files, as soon as I edit them create a name~ file without the latest changes.
That's a setting of your text editor, not of the OS.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Accidentally removed part of my TOP panel on Suse 10.0. How do I get it back?? Balarabay1 SUSE / openSUSE 3 08-20-2006 08:26 AM
removed files from /etc Spartan552 *BSD 8 11-08-2005 07:16 PM
kernel files removed cbarbot Linux - Newbie 1 04-14-2004 01:05 PM
'Accidentally' removed XFree86-libs, how can I bring back the desktop? freddan Fedora 3 03-22-2004 08:56 AM
Removed files-where have they gone!!!???? the_rydster Linux - General 2 11-13-2003 01:13 PM


All times are GMT -5. The time now is 06:23 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration