Linux - NewbieThis Linux forum is for members that are new to Linux.
Just starting out and have a question?
If it is not in the man pages or the how-to's this is the place!
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
I just wanna ask if there is an undo delete on linux.
I'm using RHEL 3. I accidentally delete file using rm command and i just wanted it to bring back. Is there a way to do this? Please give me the command or syntax or procedure on how to do it?
When you are working in the GUI, you have a trash folder to recover deleted files.
When you use rm in a terminal--as far as I know--there is no trash. The file is not, however, gone. When something is deleted, all that happens is that the pointer (inode) is released. There are ways of recovering such deleted files, but I am not familiar with them.
If it is really important data, the first caution is: Don't write anything else to the disk.
Search here or on Google for "file recovery", "disk recovery", etc.
I think an undelete *IS* possible, but I don't know how, yet. If you have a journaling file system, such as Ext3 or ReiserFS, and experience a sudden power outage, watch what happens when you power back on. The file system is able to recover the files that were open at the time of the crash--and, I believe that recovery is made possible because those files WERE journaled. True, this is not the same as deleting a file (setting a pointer to a file's disk location as deleted, or more likely the pointer reserving the disk space is removed from the table, thereby freeing up that space for any new writes). This is all guesswork on my part; only a thorough study of the file system will tell for sure.
I'm very interested to find out HOW to undelete/recover lost Linux files, or at least be able to view disk sectors and copy the contents to a file. If anyone finds this info, please share it with the rest of us.
In general, I've seen tricks for undeleting files on ext2 on the net.
And I agree with penguin_powered that a journaling filesystem like ext3 should always provide a way to roll back the journal (ie trace back what has been altered on the disk, until the situation just before your "rm").
But I don't know how to manually roll back the journal though.
Q: How can I recover (undelete) deleted files from my ext3 partition?
Actually, you can't! This is what one of the developers, Andreas Dilger, said about it:
In order to ensure that ext3 can safely resume an unlink after a crash, it actually zeros out the block pointers in the inode, whereas
ext2 just marks these blocks as unused in the block bitmaps and marks the inode as "deleted" and leaves the block pointers alone.
Your only hope is to "grep" for parts of your files that have been deleted and hope for the best.
How about a little script or function called 'erase' say. It shoves the file in a 'recycle bin'.
Preferably with it's original full path, i.e. '/usr/bin/whatever' would then be '/trash/usr/bin/whatever' or something like that. With mkdirtree it would be simple to accomplish. Have to look into it...
or it could simply be renamed to '/usr/bin/.whatever.delete'. It would be even more simple. Then the removed files could actually be deleted with find and rm.
or a hidden .trash directory could be created under each directory that would contain all the deleted files from that directory. i.e. '/usr/bin/whatever' would then be '/usr/bin/.trash/whatever'. Emptying .trash directories could also be done with find and rm.
Which way do you think would be the best? Other ideas?
ext2 is fairly easy to restore. You just need to re-link the inode.
ext3 (or any other journeling file system) is a bit harder. You need to use dd to dump the raw data of your partition and grep for parts of the deleted files. Once you find the physical location of the file on the disk, it may be possible to restore it. (note: this is much harder to do with binary files)