Dear all,

Accidently i have deleted the ram.conf file in the directory /opt and i want to recover the deleted file ram.conf in /opt directory and followed the below website link to recover my file but i was not able to recover,can any one help me on this

http://www.cyberciti.biz/tips/linuxu...ted-files.html

Thanks,

I used scalpel that is nice tool. but u have to configure scalpel./etc/scalpel/scalpel.conf

for more ref.
http://www.linuxforu.com/2011/09/rec...iles-in-linux/

Hi sharadchhetri,

Without using any third party tool i need to recover my deleted file and whether it is possible to do with command line.

Thanks,

I don't know about scalpel---might be interesting.

If you delete using the GUI, then check the trash. If you delete in a terminal (CLI), there is no trash---and therefor no "official" way of recovering the file.

lsof|grep filename

get process id no.

cd /proc/process_id_no.

inside search you will get the file and copy it. As you have init 1 already might be it is not opened.

use scalpel tool otherwise. but u have to configure its /etc/scalpel/scalpel.conf

http://www.linuxforu.com/2011/09/rec...iles-in-linux/

ignore my last tool advise, I was bit late to see other post

Hi !

When i run the command lsoft | grep 'ram.conf' i did'nt get any process id and i got the output as blank

Thanks,

Restore from your latest backup ...

I dont have backup for that file and i have to recover my file and is there any other way to recover my file

df -h
know from which partition you deleted the file.

eg.

debugfs -w /dev/sda2

you will get prompt like
debugfs:

type lsdel,like

debugfs: lsdel


let me know what is the output

1 members found this post helpful.

Please find the below output
I have deleted ram.conf file in /opt directory
Output:

[root@itsupport ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda7 24G 23G 0 100% /
/dev/sda6 99M 12M 83M 12% /boot
tmpfs 1010M 0 1010M 0% /dev/shm

[root@itsupport ~]# debugfs -w /dev/sda7
debugfs 1.39 (29-May-2006)
debugfs: lsdel
Inode Owner Mode Size Blocks Time deleted
0 deleted inodes found.
debugfs:

Thanks,

I am working on your issue and I found it in my system

try once again.

debugfs -w /dev/sda7
debugfs: cd /opt
debugfs: ls -d

tell me the status,it should list that .conf file , I need its inode no. <some_no.118282>

[root@itsupport ~]# debugfs -w /dev/sda7
debugfs 1.39 (29-May-2006)
debugfs: cd /opt
debugfs: ls -ld
5064161 40755 (2) 0 0 4096 19-Jul-2012 15:21 .
2 40775 (2) 0 0 4096 19-Jul-2012 15:32 ..
5098317 40755 (2) 0 0 4096 21-Jun-2012 19:09 mysqlstudy
5073036 40755 (2) 0 0 4096 2-Jun-2012 22:39 Godaddy remaining
4290867 100644 (1) 0 0 17348 9-Jul-2012 15:04 enquiry.php
4290868 100644 (1) 0 0 15149 9-Jul-2012 15:05 index.php
< 0> 0 (1) 0 0 0 medsonsdb09072012.sql
< 0> 0 (1) 0 0 0 ram.conf
5072756 100644 (1) 0 0 58292 10-Jul-2012 18:27 sendmailnkup.cf
5072755 100644 (1) 0 0 2638 10-Jul-2012 19:06 emailmessage
debugfs:

Yes now iam able to view my deleted file ram.conf from the output and now how can i recover ram.conf file.

Thanks,

do not use
ls -ld

use
ls -d

I need inode no. like this <265263>

Hi
Use the following commands

#lsof -pwln | grep deleted check whether file is still opened in any file descriptor


#lsof -Pwln | grep deleted
nautilus 1383 1000 20r REG 8,6 376 11723317 /home/arun/.local/share/gvfs-metadata/home (deleted)
nautilus 1383 1000 21r REG 8,6 32768 11723318 /home/arun/.local/share/gvfs-metadata/home-a427f454.log (deleted)