Restoring a rm'ed file?

sharpie · 02-02-2004, 03:36 AM

If you accidentally delete a file with the rm command, is there any simple way to get it back?

qwijibow · 02-02-2004, 03:46 AM

sorry no.

SciYro · 02-02-2004, 06:01 AM

reinstall whatever you deleted, its realy the only way, (btw, add an alais to bash promt so it cant heppen again, add
alias rm=rm -i

that way even if you acidently delet somthing itll ask b4 deleting

enigmasoldier · 02-02-2004, 09:24 AM

Yes there is as long as you don't do as little as possible on the system after you deleted the file. Shutdown the system as soon as possible and reboot it with one of the bootable cd based distros with a copy of The Coroners Toolkit or Autopsy. It isn't the easiest thing in the world for a newbie but it will assist you in recovering your missing files.

Links:
http://biatchux.dmzs.com A great disaster recovery bootable linux cd
http://www.sleuthkit.org/autopsy/desc.php
http://www.porcupine.org/forensics/tct.html
http://www.fish.com/tct/help-recovering-file

SciYro · 02-02-2004, 09:48 AM

if i remember right, every FS has a difrent way of storing files and such, so every fs needs special tool to recover things on its partion (like i don think a recovery tool make for NTFS will work on ReiserFS)

enigmasoldier · 02-03-2004, 01:54 AM

That is true Sciyro but those are computer forensics tools designed to do just that. Find hidden or deleted files.

SciYro · 02-03-2004, 03:05 AM

i never thought there were general forensic tools, can you give us a addres?