How to get back removed files?
 

Hi there,

I would like to know how to restore my removed files from the bash shell.

For instance;
How to restore fileBoo.txt? Is this possible?

Thanks,

No, it's not possible.

It *MAY* be possible, depending on the file system in use. It is, however, a non-trivial task.

If the filesystem that you are using is EXT2/3, it is possible to get files back. Install or look for e2undel.e

It is possible to recover files from other filesystems, but it is not easy. For ReiserFS, read http://antrix.net/journal/techtalk/r...howto.comments. Next time quadruple check before hitting enter. Other filesystems will have to first use their dump utility and then use their restore utility afterwards. In simpler terms, always backup. If you do not like Linux present filesystems because of the this problem, you can design your filesystem that has undelete and unformat features.

I suggest writing a script so this does not happen. In the script, you can move the file from source to the destination directory that is stored on another hard drive. Yes, you will have to have two hard drives. One for your data and other for temp data storage.

files are always recoverable--in any file system--unless you write to the disk after deleting the file.
The question is how hard will the recovery be......;)

If you lose irreplaceable data, do not write to the disk

I find there's a lot of shoulds and mays in e2undels description, and the project hasn't seen any change for nearly 3 years now. Is it reliable, has anybody really used it recently?

Still, I think the best assumption one should make is that those files are not recoverable and that you need to double-check before pressing enter. Also, backups are a most useful thing. Otherwise, I'd suggest a tool like libtrash which implements a Windows-like recycle bin on the file system level.

I don't know if I start a mini thread by asking this (correct me if I do) but why exactly are deleted files so easy to recover in Windows? I also thought deleted files in Linux were deleted for ever.

I think there's no difference between Windows and Linux. If you delete a file in a graphical environment (Windows Explorer, Gnome Nautilus, KDE Konqueror), it usually gets moved to some kind of trash bin where you can recover it. It's implemented by the desktop environment, not by the OS.

If you do the same in a CLI, it's deleted forever. But due to the fact that the CLI is used much more often in Linux, it appears to be a Linux flaw - it isn't.

Still, the only reliable way to work against this is 1) backups and 2) implement a trash bin on the file system level, i.e. to think about the problem before it happens and not after it happened.

The file recovery tools have their use but they there's no guarantee that they will work, especially in a typical setup where /var and / are on the same partition, because /var gets written to all the time and, again depending on the file system, this will sooner or later overwrite the deleted file.

Well, we've now lost the OP---sadly all too common that we may never know if he/she solved the problem.
I am very interested in learning more about file recovery. Are there forums specifically on the topic?

I remember using an undelete command in DOS. There you got a list of recently deleted files with partly filenames, and when you filled out the name the file was recovered (sounds like hangman doesn't it, fill in the right name and you win! :) ). It think I used once or twice, but as far as I can remember it worked fine.

Depending on how the system is set up, a temp text file with name foofile~ would probably be the easiest you'd come to a deleted file.

this is a hidden file and most modern distros keep such a backup.

Yes, as of MSDOS 5. I haven't used Windows recently, but I don't think that it still works.

FAT12, 16 and FAT32 are the easiest to undelete files because they replace the first letter of the filename to ?. Since this is illegal, it does not show and the space that this file is taken up is marked to be over write or unused.

Linux filesystems are different because the file name is erased completely off the list. In order to find the file, you will have to search the whole entire partition. Utilities will go by inodes, but finding the correct inodes is like finding special needles in a bunch of needles.


All Linux distributions can not undelete files and no they do not keep backups. Yes, finding deleted text files are a little easier, but it is still time consuming.

Electro, I've seen backup files in both ubuntu and fedora. maybe I was misunderstood.

I didn't say the backup file is created when you delete a file. I'm just saying that there is one.

In my experience, all text files, as soon as I edit them create a name~ file without the latest changes.

That's a setting of your text editor, not of the OS.