LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices

Reply
 
Search this Thread
Old 06-24-2006, 06:35 AM   #1
dojiep
LQ Newbie
 
Registered: May 2006
Location: Valenzuela, Philippines
Distribution: Redhat
Posts: 8

Rep: Reputation: 0
undo delete


Hi!

I just wanna ask if there is an undo delete on linux.
I'm using RHEL 3. I accidentally delete file using rm command and i just wanted it to bring back. Is there a way to do this? Please give me the command or syntax or procedure on how to do it?

Thanks in advance!

Dojie
 
Old 06-24-2006, 07:25 AM   #2
vls
Member
 
Registered: Jan 2005
Location: The grassy knoll
Distribution: Slackware,Debian
Posts: 192

Rep: Reputation: 31
Sorry, but it's gone. rm is a one-way street. You might want to get yourself in the habit of typing rm -i as that will ask for confirmation. And always double check your arguments whenever using rm.
 
Old 06-24-2006, 07:30 AM   #3
SlackDaemon
Member
 
Registered: Mar 2006
Distribution: RedHat, Slackware, Experimenting with FreeBSD
Posts: 222

Rep: Reputation: 30
Undelete not available yet

hi dojiep,

undoing deletes is not possible yet. It is in the works though. The extended attribute 'u' will be able to do this for you in the future.


for now you should alias your rm command to 'rm -i'
 
Old 06-24-2006, 07:35 AM   #4
vls
Member
 
Registered: Jan 2005
Location: The grassy knoll
Distribution: Slackware,Debian
Posts: 192

Rep: Reputation: 31
Quote:
Originally Posted by SlackDaemon
hi dojiep,

undoing deletes is not possible yet. It is in the works though. The extended attribute 'u' will be able to do this for you in the future.


for now you should alias your rm command to 'rm -i'
Interesting, hadn't heard about that 'u' thing.

And just an opinion, never alias rm, just get used to typing rm -i.
 
Old 06-24-2006, 07:42 AM   #5
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Arch/XFCE
Posts: 17,802

Rep: Reputation: 729Reputation: 729Reputation: 729Reputation: 729Reputation: 729Reputation: 729Reputation: 729
When you are working in the GUI, you have a trash folder to recover deleted files.

When you use rm in a terminal--as far as I know--there is no trash. The file is not, however, gone. When something is deleted, all that happens is that the pointer (inode) is released. There are ways of recovering such deleted files, but I am not familiar with them.

If it is really important data, the first caution is: Don't write anything else to the disk.

Search here or on Google for "file recovery", "disk recovery", etc.
 
Old 06-24-2006, 05:14 PM   #6
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,004
Blog Entries: 11

Rep: Reputation: 903Reputation: 903Reputation: 903Reputation: 903Reputation: 903Reputation: 903Reputation: 903Reputation: 903
If the box is using ext2 you can probably recover the file using
MidnightCommander. With ext3 or other file-systems you're out of
luck, though.


Cheers,
Tink
 
Old 08-04-2006, 05:51 AM   #7
penguin_powered
LQ Newbie
 
Registered: Apr 2004
Location: Houston, Texas
Distribution: Linux Mint 13, MATE 32-bit edition
Posts: 24

Rep: Reputation: 15
I think an undelete *IS* possible, but I don't know how, yet. If you have a journaling file system, such as Ext3 or ReiserFS, and experience a sudden power outage, watch what happens when you power back on. The file system is able to recover the files that were open at the time of the crash--and, I believe that recovery is made possible because those files WERE journaled. True, this is not the same as deleting a file (setting a pointer to a file's disk location as deleted, or more likely the pointer reserving the disk space is removed from the table, thereby freeing up that space for any new writes). This is all guesswork on my part; only a thorough study of the file system will tell for sure.

I'm very interested to find out HOW to undelete/recover lost Linux files, or at least be able to view disk sectors and copy the contents to a file. If anyone finds this info, please share it with the rest of us.
 
Old 08-04-2006, 08:55 AM   #8
timmeke
Senior Member
 
Registered: Nov 2005
Location: Belgium
Distribution: Red Hat, Fedora
Posts: 1,515

Rep: Reputation: 61
http://e2undel.sourceforge.net/usage.html
seems nice. Haven't tried it though.
There is a link to a "howto" at the top of the page.

In general, I've seen tricks for undeleting files on ext2 on the net.
And I agree with penguin_powered that a journaling filesystem like ext3 should always provide a way to roll back the journal (ie trace back what has been altered on the disk, until the situation just before your "rm").
But I don't know how to manually roll back the journal though.
 
Old 08-04-2006, 10:13 AM   #9
alienDog
Member
 
Registered: Apr 2004
Location: Europe
Distribution: Debian, Slackware
Posts: 505

Rep: Reputation: 46
From: http://batleth.sapienti-sat.org/proj...ext3-faq.html:

Quote:
Q: How can I recover (undelete) deleted files from my ext3 partition?
Actually, you can't! This is what one of the developers, Andreas Dilger, said about it:
In order to ensure that ext3 can safely resume an unlink after a crash, it actually zeros out the block pointers in the inode, whereas
ext2 just marks these blocks as unused in the block bitmaps and marks the inode as "deleted" and leaves the block pointers alone.

Your only hope is to "grep" for parts of your files that have been deleted and hope for the best.
Might have some luck on ReiserFS though: http://antrix.net/journal/techtalk/r...howto.comments

Last edited by alienDog; 08-04-2006 at 10:16 AM.
 
Old 08-04-2006, 10:41 AM   #10
lugoteehalt
Senior Member
 
Registered: Sep 2003
Location: UK
Distribution: Debian
Posts: 1,215
Blog Entries: 2

Rep: Reputation: 49
How about a little script or function called 'erase' say. It shoves the file in a 'recycle bin'.
 
Old 08-04-2006, 10:58 AM   #11
alienDog
Member
 
Registered: Apr 2004
Location: Europe
Distribution: Debian, Slackware
Posts: 505

Rep: Reputation: 46
Quote:
Originally Posted by lugoteehalt
How about a little script or function called 'erase' say. It shoves the file in a 'recycle bin'.
Preferably with it's original full path, i.e. '/usr/bin/whatever' would then be '/trash/usr/bin/whatever' or something like that. With mkdirtree it would be simple to accomplish. Have to look into it...

--edit--

or it could simply be renamed to '/usr/bin/.whatever.delete'. It would be even more simple. Then the removed files could actually be deleted with find and rm.

--edit--

or a hidden .trash directory could be created under each directory that would contain all the deleted files from that directory. i.e. '/usr/bin/whatever' would then be '/usr/bin/.trash/whatever'. Emptying .trash directories could also be done with find and rm.

Which way do you think would be the best? Other ideas?

Last edited by alienDog; 08-04-2006 at 11:06 AM.
 
Old 08-04-2006, 11:20 AM   #12
lugoteehalt
Senior Member
 
Registered: Sep 2003
Location: UK
Distribution: Debian
Posts: 1,215
Blog Entries: 2

Rep: Reputation: 49
The last one's vaughly the way Windows does it, isn't it? At least there's a 'trash' ?subdirectory in every directory from which something has been deleted, a hidden, 'system' file.
 
Old 08-04-2006, 11:25 AM   #13
alienDog
Member
 
Registered: Apr 2004
Location: Europe
Distribution: Debian, Slackware
Posts: 505

Rep: Reputation: 46
Quote:
Originally Posted by lugoteehalt
The last one's vaughly the way Windows does it, isn't it? At least there's a 'trash' ?subdirectory in every directory from which something has been deleted, a hidden, 'system' file.
Oh, that must be the wrong way then ;D
 
Old 08-05-2006, 04:39 AM   #14
drkstr
Senior Member
 
Registered: Feb 2006
Location: Seattle, WA: USA
Distribution: Slackware 11.0
Posts: 1,191

Rep: Reputation: 45
ext2 is fairly easy to restore. You just need to re-link the inode.

ext3 (or any other journeling file system) is a bit harder. You need to use dd to dump the raw data of your partition and grep for parts of the deleted files. Once you find the physical location of the file on the disk, it may be possible to restore it. (note: this is much harder to do with binary files)

Hope you like hex!

...drkstr
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
VI and UNDO jinksys Linux - Software 1 07-30-2005 05:46 PM
How do i undo this?! Jengo Slackware 2 07-13-2004 12:50 PM
undo rm * slackmagic General 3 04-25-2004 05:16 PM
i know what i have done ! how do i undo it ? ethereal9 Mandriva 2 10-03-2003 06:19 PM
How to undo this? latino Linux - Software 4 09-21-2003 09:45 AM


All times are GMT -5. The time now is 11:37 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration