undo delete
 

Hi!

I just wanna ask if there is an undo delete on linux.
I'm using RHEL 3. I accidentally delete file using rm command and i just wanted it to bring back. Is there a way to do this? Please give me the command or syntax or procedure on how to do it?

Thanks in advance!

Dojie

Sorry, but it's gone. rm is a one-way street. You might want to get yourself in the habit of typing rm -i as that will ask for confirmation. And always double check your arguments whenever using rm.

Undelete not available yet
 

hi dojiep,

undoing deletes is not possible yet. It is in the works though. The extended attribute 'u' will be able to do this for you in the future.


for now you should alias your rm command to 'rm -i'

Interesting, hadn't heard about that 'u' thing.

And just an opinion, never alias rm, just get used to typing rm -i. :twocents:

When you are working in the GUI, you have a trash folder to recover deleted files.

When you use rm in a terminal--as far as I know--there is no trash. The file is not, however, gone. When something is deleted, all that happens is that the pointer (inode) is released. There are ways of recovering such deleted files, but I am not familiar with them.

If it is really important data, the first caution is: Don't write anything else to the disk.

Search here or on Google for "file recovery", "disk recovery", etc.

If the box is using ext2 you can probably recover the file using
MidnightCommander. With ext3 or other file-systems you're out of
luck, though.


Cheers,
Tink

I think an undelete *IS* possible, but I don't know how, yet. If you have a journaling file system, such as Ext3 or ReiserFS, and experience a sudden power outage, watch what happens when you power back on. The file system is able to recover the files that were open at the time of the crash--and, I believe that recovery is made possible because those files WERE journaled. True, this is not the same as deleting a file (setting a pointer to a file's disk location as deleted, or more likely the pointer reserving the disk space is removed from the table, thereby freeing up that space for any new writes). This is all guesswork on my part; only a thorough study of the file system will tell for sure.

I'm very interested to find out HOW to undelete/recover lost Linux files, or at least be able to view disk sectors and copy the contents to a file. If anyone finds this info, please share it with the rest of us. ;)

http://e2undel.sourceforge.net/usage.html
seems nice. Haven't tried it though.
There is a link to a "howto" at the top of the page.

In general, I've seen tricks for undeleting files on ext2 on the net.
And I agree with penguin_powered that a journaling filesystem like ext3 should always provide a way to roll back the journal (ie trace back what has been altered on the disk, until the situation just before your "rm").
But I don't know how to manually roll back the journal though.

From: http://batleth.sapienti-sat.org/proj...ext3-faq.html:

Might have some luck on ReiserFS though: http://antrix.net/journal/techtalk/r...howto.comments

How about a little script or function called 'erase' say. It shoves the file in a 'recycle bin'.

Preferably with it's original full path, i.e. '/usr/bin/whatever' would then be '/trash/usr/bin/whatever' or something like that. With mkdirtree it would be simple to accomplish. Have to look into it... ;)

--edit--

or it could simply be renamed to '/usr/bin/.whatever.delete'. It would be even more simple. Then the removed files could actually be deleted with find and rm.

--edit--

or a hidden .trash directory could be created under each directory that would contain all the deleted files from that directory. i.e. '/usr/bin/whatever' would then be '/usr/bin/.trash/whatever'. Emptying .trash directories could also be done with find and rm.

Which way do you think would be the best? Other ideas?

The last one's vaughly the way Windows does it, isn't it? At least there's a 'trash' ?subdirectory in every directory from which something has been deleted, a hidden, 'system' file.

Oh, that must be the wrong way then ;D

ext2 is fairly easy to restore. You just need to re-link the inode.

ext3 (or any other journeling file system) is a bit harder. You need to use dd to dump the raw data of your partition and grep for parts of the deleted files. Once you find the physical location of the file on the disk, it may be possible to restore it. (note: this is much harder to do with binary files)

Hope you like hex!

...drkstr