[+PLUS][I+MM] Recovering files in Linux

[santhosh Thottingal]

* * *Recovering files in Linux*

Imagine, you have been working for days on these files, it's your
masterpiece. OK now, just delete these vi backups before releasing it... you
type:

rm ~ *

Oh nooooooooooooo, your fingers slipped and touched the spacebar. All you
files are gone!!!! What should you do? Commit suicide, harakiri? No, it
might still be possible to recover some files...
 ------------------------------

In order to undelete a file, you must know the following things:

   - On which device your file was stored
   - What kind of file system was used (eg. ext2, reiserFS, vfat)

To find it out, type 'mount | column -t' in the shell, or to make it evan
more easy, copy-paste or type this into your shell:



echo "DEVICE DIRECTORY FS-TYPE" > tmp; mount | cut -d" " -f1,3,5 | \




sort >> tmp; cat tmp | column -t | sed -e "1s/.*/`tput smso`&`tput rmso`/"

The output should be something like this:





bash$ mount | column -t

/dev/hda5  on  /               type  ext2      (rw)



proc       on  /proc           type  proc      (rw)

usbdevfs   on  /proc/bus/usb   type  usbdevfs  (rw)

devpts     on  /dev/pts        type  devpts    (rw)




/dev/hda1  on  /mnt/windows/C  type  vfat      (rw,noexec,nosuid,nodev)


/dev/hda6  on  /mnt/windows/E  type  vfat      (rw,noexec,nosuid,nodev)

/dev/hdc5  on  /mnt/oldwin     type  vfat      (rw,noexec,nosuid,nodev)





bash$ echo "DEVICE DIRECTORY FS-TYPE" > tmp; mount | cut -d" " -f1,3,5 | \



sort >> tmp; cat tmp | column -t | sed -e "1s/.*/`tput smso`&`tput rmso`/"

DEVICE     DIRECTORY       FS-TYPE

/dev/hda1  /mnt/windows/C  vfat

/dev/hda5  /               ext2

/dev/hda6  /mnt/windows/E  vfat

/dev/hdc5  /mnt/oldwin     vfat

devpts     /dev/pts        devpts

proc       /proc           proc

usbdevfs   /proc/bus/usb   usbdevfs

Now, of which (printed) directory was the directory of your deleted file a
subdirectory? E.g. if your file was stored on /home/user , you'll have to
look for '/', since no closer match can be found. Found it? Cool, right now
it's a piece of cake to find the device on which the file was stored and the
filesystem type of the device.

Ok, now you know the essentials to undelete a file. This can be done in
several ways:

   - If the filesystem is ext2:


    - recover <http://recover.sourceforge.net/linux/recover/>
      - Midnight Commander


   - Not ext2:


    - Read your file-system's manual
      - The unix way <http://recover.sourceforge.net/unix/>

I hope this helps. If you need more help, try searching
google<http://www.google.com/>for more info. Good luck!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.sarovar.org/pipermail/plus-discuss/attachments/20060303/04b1ae76/attachment.xhtml