How do you restore a file that has been removed via the rm command?

EnderX · 02-06-2007, 10:53 AM

By mistake, I accidentally deleted a set of postgresql .conf files from a linux server I work with. The server is running SuSE 9.2 linux. The textbook I am trying to work with, The Linux Book by David Elboth, does not say how to restore a file that has been removed via rm, although the rm man page does indicate that it is possible. I have copies of the .conf files from another installation of postgres that I might be able to use, but I am not certain that they have the exact same details as the original files; if possible, I would greatly prefer to restore the old ones I accidentally got rid of. Would someone please let me know what command or commands I need to try to do so, or else let me know of another website where I can search for those commands?

Thank you for your consideration,
EnderX

kdrlx · 02-06-2007, 12:02 PM

Google says -
http://www.ccl.net/cca/software/UNIX...rm/index.shtml
http://servers.linux.com/article.pl?...58230&from=rss

Tinkster · 02-08-2007, 01:21 AM

Quote:

Originally Posted by EnderX

By mistake, I accidentally deleted a set of postgresql .conf files from a linux server I work with. The server is running SuSE 9.2 linux. The textbook I am trying to work with, The Linux Book by David Elboth, does not say how to restore a file that has been removed via rm, although the rm man page does indicate that it is possible. I have copies of the .conf files from another installation of postgres that I might be able to use, but I am not certain that they have the exact same details as the original files; if possible, I would greatly prefer to restore the old ones I accidentally got rid of. Would someone please let me know what command or commands I need to try to do so, or else let me know of another website where I can search for those commands?

Thank you for your consideration,
EnderX

If you didn't modify them from what they were like
you could just take the originals from wherever you
installed from. Most linux-filesystems per se do not
provide an undelete facility. For ext2 there are some
tools, for others grep and knowing the files content
may be able to locate and manually restore them.

Cheers,
Tink

pixellany · 02-08-2007, 08:50 AM

Quote:

Originally Posted by EnderX

The textbook I am trying to work with, The Linux Book by David Elboth, does not say how to restore a file that has been removed via rm, although the rm man page does indicate that it is possible.

Perhaps you are referring to this--from man rm:

Quote:

Note that if you use rm to remove a file, it is usually possible to recover the contents of that file. If you want more assurance that the contents are truly unrecoverable, consider using shred.

In this context, "recoverable" means using special-purpose tools and a moderate dose of patience.
The intent of the message in man rm is that rm is not a secure erase.

farslayer · 02-08-2007, 10:48 AM

First thing you should do is take the server off-line to prevent the system from overwriting the disk areas that contain the files you wish to recover.. or unmount the volumes containing that data. Those volumes should only be mounted as read only until the data is recovered, or images of the partitions have been made. it's usually not a bad idea to make TWO copies of the partition using dd. One copy to use for doing the restore work, and one copy in case you mess up the image you are working on the restore from.. it's best not to do your recovery work directly on the live system..

You would then need to use some of the Linux forensics tools to locate and recover the data.

Some of the LIVE forensics CD's would be a good place to start..
FIRE, HELIX or a similar forensic distribution.
http://www.livecdlist.com/?pick=All&...ics&sort=&sm=1

Alternately you can pull out your backup tape and restore the files from backup..........
Server in a commercial environment you must have backups right ?