• Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other Pie Elite all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Tim Cooke
  • Ron McLeod
  • Jeanne Boyarsky
  • Paul Clapham
Sheriffs:
  • Liutauras Vilda
  • Henry Wong
  • Devaka Cooray
Saloon Keepers:
  • Tim Moores
  • Stephan van Hulst
  • Tim Holloway
  • Al Hobbs
  • Carey Brown
Bartenders:
  • Piet Souris
  • Mikalai Zaikin
  • Himai Minh

recovery after rm command

 
Ranch Hand
Posts: 136
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
In windows if we delete any file, it goes in recycle bean.
If we delete any file using rm command in unix where it goes?
How to recover that file?
 
author and iconoclast
Posts: 24204
44
Mac OS X Eclipse IDE Chrome
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
It doesn't go anywhere; it's deleted. The same thing happens in Windows if you use "del" from the command line.

Some of the file's data may be recoverable, but it's unlikely. It depends on what filesystem you're using, and how the system has been used since the file was deleted. If you're using ext2fs you may be able to recover your file; see here. It's some major dark magic, though; if you're not a Linux wizard it's unlikely you'll be able to do it. If you're using the more modern ext3fs, you're pretty much completely out of luck.

Sorry for the bad news.
 
Minal Silimkar-Urankar
Ranch Hand
Posts: 136
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator

Originally posted by Ernest Friedman-Hill


Sorry for the bad news.



Ernest Friedman, whatever information you have given is not at all a bad news, but at least you showed me a way


Some of the file's data may be recoverable, but it's unlikely. It depends on what filesystem you're using, and how the system has been used since the file was deleted. If you're using ext2fs you may be able to recover your file;



Is it applicable operating system’s like Solaris, HPUX, AIX?
 
Ernest Friedman-Hill
author and iconoclast
Posts: 24204
44
Mac OS X Eclipse IDE Chrome
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
Every UNIX OS supports one or more filesystem types, often specific to that OS. For the original UNIX filesystems, the answer was always what I've given here. There's certainly a chance, though, that these days one or more of these other UNIX flavors might offer a filesystem that allows file undelete -- I just don't personally know of one. I have to confess I don't have detailed knowledge of current AIX, Solaris, or HP-UX features.
 
Minal Silimkar-Urankar
Ranch Hand
Posts: 136
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
I know about rm command is, if we delete any file it permanently deletes inode number from inode file table. Is there any chance of storing reference or getting reference of deleted file?
 
author and jackaroo
Posts: 12199
280
Mac IntelliJ IDE Firefox Browser Oracle C++ Java
  • Likes 1
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
If you are talking about storing a reference to a deleted file, I assume you are talking about trying to protect yourself from deleting a file by accident in the future. If so, then a simple solution might be creating a deletion script then aliasing your rm command to point to it. Something like:



Where the deleteFile script might look something like:



So - it first checks if there is a file in /tmp that has the same name as the file you are about to delete. If so, it renames it by appending the year, month, day, hour, minute, second to the file. This means you can actually go back several versions.

It then moves whatever file you are attempting to delete to the /tmp directory. Note that this in itself might be a security risk as you might be moving files from your private directories to a common shared directory.

Many operating systems have the concept of a trash folder that can be accessed from the GUI interface. You may prefer to modify the script above to put files into that directory (where ever it happens to be). On my Ubuntu system it is ~/.local/share/Trash/files/ On my Macintosh it is ~/.Trash

Andrew
 
Ranch Hand
Posts: 1923
Scala Postgres Database Linux
  • Mark post as helpful
  • send pies
    Number of slices to send:
    Optional 'thank-you' note:
  • Quote
  • Report post to moderator
And backup often, so you may recover from your backup.

If you know some content of your file, you might use dd and grep to filter a whole partition, which might take a long, long time for todays harddrives.

I.e.:
would scan the first partition of the first drive on my linux-system, and scan the whole thing - deleted or not - for the text "secret, expensive information".
 
reply
    Bookmark Topic Watch Topic
  • New Topic