Someone in my family has deleted a file (by "mv crap important") and is not in the best of moods, to say the least. I tried to "recover" it (its ext3), but it doesnt seem to pick up any deleted inodes. When a file is "mv"ed is it unlinked differently - is there any way to recover it?

thx for any quick responses.

mv moves it right?? so it should be somewhere else, not deleted???

if in
# mv crap important

"important" was not an existing directory, you could type:

#mv important crap

and be back to square 1. If "important" was an existing directory, you should be able to recover with:

#mv important/crap .
including the dot ath the end.


of course you should change directory to where the file or directory was in the first place.

Hope this helps.

sry, about that. I guess I was unclear. both crap and important were files not directories - so, it doesnt "move it", but "replace it" (or hence, delete the original)

UPDATE:
the situation iss under control, we found an old backup of it...close call.

I'd still like to know if there is a difference in the way mv unlinks nodes and rm unlinks them. And how could one recover from a "mv" - I dont think rewritten nodes were a problem in this case, since I was informed of the situation rather quickly.

Any one out there would like to shed some light?

mv moves files, so it should just be somewhere else. As for un-deleting things... that is tricky, if not impossible, in Linux. (I recently read something about searching your journal files for bits of text content, to see if the file is still floating around in there, but no guarantees).

If you remember the name of it, you can see if you can figure out where it got moved to. As whichever user moved the file, try:

find / -name filename

I do believe that a mv is equivalent to a cp, and then a rm, for several observational reasons. First, if I attempt to mv a directory tree for which I have read, but not write permission, the files are copied, and then an error occurs during the unlink process. Second, on AIX (which, no is not Linux) a mv results in first cp showing up in top, and then an rm (in addition to an mv at lower usage), indicating that the process is explicitly that. I guess the definitive answer would be to compare the source on your implementation for cp, rm, and mv.

It all depends if the source and destination are on the same filesystem or not. A move between 2 filesystems are like a copy; rm. On the other hand, a move within the same filesystem is just a rename. The data stays where it is.

Just try

ls -i
before and after a mv and compare it to the

ls -i

before and after a copy..

This sounds like a case for setting up some aliases for those unwary users:

alias mv='mv -i'
alias rm='rm -i'

etc.

At least they have to stop and think (hopefully) when they see that prompt. And if that's not enough, show 'em to write protect the files: chmod -w important.stuff. And when you've finished with that lesson, develop that backup strategy. :-)

mod note: *NOTHING* is "urgent" here please.

sorry for being confused... I understand its only a rename. but if the destination already exists, then the src overwrites the destination. correct? then how would one retrive the original dest. file after there was no name to refer it to. the way I see it:

I dont know about order, but it sounds like:
if dest==1; rm dest
cp src dest;
rm src;

am i completely off track?

good advice, rnturn. thx.

sry about that acid_kewpie. I guess I acted a little hastily. Just got caught up in the moment.

what do you mean retrieve? if you've over written a file then it's gone....

so mv does not remove the old dest (if one exists). It just writes over it...correct?

this was my original question....I just wanted to know if it gets written over, or if it unlinks the old destination (and then if one's lucky, one can retrieve it)?

oh well...now that I think about it, a "written over" would make more sense. If so, thanks for the ideas guys. but I guess it's gone....