Recover from rm

In order to undelete a file, you must know the following things:
• On which device your file was stored
• What kind of file system was used (eg. ext2, reiserFS, vfat)
To find it out, type 'mount | column -t'

Or
echo "DEVICE DIRECTORY FS-TYPE" > tmp; mount | cut -d" " -f1,3,5 | sort >> tmp; cat tmp | column -t | sed -e "1s/.*/`tput smso`&`tput rmso`/"

The output should be something like this:

bash$ mount | column -t
/dev/hda5 on / type ext2 (rw)
proc on /proc type proc (rw)
usbdevfs on /proc/bus/usb type usbdevfs (rw)
devpts on /dev/pts type devpts (rw)
/dev/hda1 on /mnt/windows/C type vfat (rw,noexec,nosuid,nodev)
/dev/hda6 on /mnt/windows/E type vfat (rw,noexec,nosuid,nodev)
/dev/hdc5 on /mnt/oldwin type vfat (rw,noexec,nosuid,nodev)

Now, of which (printed) directory was the directory of your deleted file a subdirectory? E.g. if your file was stored on /home/user , you'll have to look for '/', since no closer match can be found. Found it? Cool, right now it's a piece of cake to find the device on which the file was stored and the filesystem type of the device.

If you really need to undelete a file, that's the way to do it:
grep -a -B[size before] -A[size after] 'text' /dev/[your_partition]
Replace [size before], [size after] and [your_partition] with something meaningfull. Don't know what your partition is? Read the Linux undelete
.g.: If you want to undelete a letter (+- 200 lines) starting with "Hi mum" which was stored on /dev/hda1 you can try:
grep -a -B2 -A200 "Hi mum" /dev/hda1
Make sure you do this as root (System administrator)

Comments

CSPK said…
Thanks man... It actually works.. I am glad because now i dont have to worry about rm any more...
YouthOfUnity said…
Prabhat,

Thanks for posting the recover from "rm" instructions, do you know if they would work for Darwin/Macbook Pro as well ?

Thanks,
-Kamal.
Anonymous said…
Woa! Thank you so much, you just saved me 3+ hours of work, that I mistakenly deleted using a wildcard.
Anonymous said…
thanks a ton, i'd heard from other places that this was impossible, but it worked great.
Anonymous said…
Sounds like a pretty easy solution. Thanks for sharing.
How would you recover a directory as opposed to a file?
Anonymous said…
Checkout extundelete http://extundelete.sourceforge.net/

Popular posts from this blog

How do I Use the Linux Top Command?

IOPS measurement