Linux - NewbieThis Linux forum is for members that are new to Linux.
Just starting out and have a question?
If it is not in the man pages or the how-to's this is the place!
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Introduction to Linux - A Hands on Guide
This guide was created as an overview of the Linux Operating System, geared toward new users as an exploration tour and getting started guide, with exercises at the end of each chapter.
For more advanced trainees it can be a desktop reference, and a collection of the base knowledge needed to proceed with system and network administration. This book contains many real life examples derived from the author's experience as a Linux system and network administrator, trainer and consultant. They hope these examples will help you to get a better understanding of the Linux system and that you feel encouraged to try out things on your own.
Click Here to receive this Complete Guide absolutely free.
I'm not a newbie but might as well be considering the blunder I just made. I accidentally deleted an email from an alpine folder in which I had saved all the emails between me and a correspondent. I realize this folder is actually a file, so what I really did was modify the file. I wanted to go back to the original, slightly longer file prior to it being modified by deleting that one email, so I searched for and found online instructions that I thought would do the job. Alas, in following those instructions I managed to somehow make all the contents of the file vanish. When I opened the file in alpine all I had was a blank screen. After a number of futile efforts at retrieving the data I gave up, deleted the file, and restored about half or two-thirds of the original file from a 2½ year old tar backup. I've asked my correspondent to send me all of our correspondence subsequent to June 20, 2010, but I'm not sure he has it all or if it'll be in a form I can manipulate once I get it (i.e., header info). For that reason, and also for general curiosity, I'm still wondering if there's a way to retrieve the info, since it's still on my hard drive and has probably mostly not been overwritten yet. I have the inode number, which I got while following the previously mentioned instructions. I also saw, at some point, a screen that gave beginning and ending block numbers, or something of that sort, but I didn't write it down at that point and don't know if that sort of thing would be saved to a log file, what log file that would be, or if it would be in a human readable form. My questions are: 1) what can I do with that inode number, if anything, to retrieve the contents of the original file; 2) is there a place to look, and if necessary a way to read, a log file containing the contents of the screen mentioned above? Feel free to spell out the several things I've done wrong, in case I've missed anything in my recriminations, but please don't rub in the fact that I've been stupid. I already figured that out. Any help and/or educational tips will be appreciated.
please don't rub in the fact that I've been stupid. I already figured that out.
I wouldn't call it stupid, I'd say you were unprepared. And with that you find yourself in the company of both new as well as seasoned Linux users. The difference is what you take away from the experience like finally deciding that making daily backups is a Good Thing...
The problem with deletion is that a lot of aspects work against you to deteriorate the situation and lessen chances of recovery: hardware, kernel, file system, anything that does write ops but most of all time. The best first reflex after deletion is to immediately remount the partition read-only or else immediately bring the machine down. The second reflex then should be to make a 'dd' copy of the partition to a file on a physically different partition or disk to ensure you have a backup. This backup then serves as "frozen", unalterable starting point. Without going into file system characteristics like secondary and tertiary indirect block allocation Mbox format is plain text meaning that you can easily do things in parallel like on the one hand have header / footer carvers like Photorec, Foremost, Scalpel or tools like extundelete search for text snippets and OTOH grep the image or use a hexeditor.