From: hamilton@golem.wcc.govt.nz (Michael Hamilton) Subject: Re: Undelete for linux? Date: 28 Jul 1993 12:29:55 +1200
In article <22o217INNbge@uwm.edu> albion@csd4.csd.uwm.edu (Craig T Manske) writes:
>
>Is there an undelete for linux?
>
>Albion
>albion@csd4.csd.uwm.edu
As you've probably read - not yet.
But I have used the following method once after I accidentally rm'ed a
C++ source file I was working on. It's mainly limited to when you
remove one or two files that are easily identifiable by content. I
realised my mistake almost immediately and unmounted the file system.
I then egrep'ed the raw disk device for something I knew would be in
the file. Once I located the string I re-egrep'ed to give me the
context surrounding the match.
Egrep was pretty fast at running through the 80MB file system, and
located a more or less complete version of the file. Note that copies
of source code might exist in temporary files in other file systems if
compiled recently (but probably also deleted) - I actually found a copy
of my file that had be somewhat pre-processed by GCC.
This won't work for files that were never synced out, or for files
that can't be easily identified, or for really fragmented files, or
when you can't arbitrarily bring the system down, ... But I thought
I'd mention it in case anyone else finds themselves in a similar
situation, it's worth a shot.
-- Michael Hamilton, Information Technology, Wellington City Council, P.O. Box 2199, Wellington, New Zealand. Phone: (64) (4)801-3317 FAX: (64) (4)801-3020 Domain: hamilton@golem.wcc.govt.nz PSImail: PSI%0530147000090::HAMILTON