recovery after rm command

[Minal Silimkar-Urankar]

In windows if we delete any file, it goes in recycle bean.
If we delete any file using rm command in unix where it goes?
How to recover that file?

[Ernest Friedman-Hill]

It doesn't go anywhere; it's deleted. The same thing happens in Windows if you use "del" from the command line.

Some of the file's data may be recoverable, but it's unlikely. It depends on what filesystem you're using, and how the system has been used since the file was deleted. If you're using ext2fs you may be able to recover your file; see here. It's some major dark magic, though; if you're not a Linux wizard it's unlikely you'll be able to do it. If you're using the more modern ext3fs, you're pretty much completely out of luck.

Sorry for the bad news.

[Minal Silimkar-Urankar]

Originally posted by Ernest Friedman-Hill

Sorry for the bad news.

Ernest Friedman, whatever information you have given is not at all a bad news, but at least you showed me a way

Some of the file's data may be recoverable, but it's unlikely. It depends on what filesystem you're using, and how the system has been used since the file was deleted. If you're using ext2fs you may be able to recover your file;

Is it applicable operating system’s like Solaris, HPUX, AIX?

[Ernest Friedman-Hill]

Every UNIX OS supports one or more filesystem types, often specific to that OS. For the original UNIX filesystems, the answer was always what I've given here. There's certainly a chance, though, that these days one or more of these other UNIX flavors might offer a filesystem that allows file undelete -- I just don't personally know of one. I have to confess I don't have detailed knowledge of current AIX, Solaris, or HP-UX features.

[Minal Silimkar-Urankar]

I know about rm command is, if we delete any file it permanently deletes inode number from inode file table. Is there any chance of storing reference or getting reference of deleted file?

[Andrew Monkhouse]

If you are talking about storing a reference to a deleted file, I assume you are talking about trying to protect yourself from deleting a file by accident in the future. If so, then a simple solution might be creating a deletion script then aliasing your rm command to point to it. Something like:

alias rm='~/bin/deleteFile'

Where the deleteFile script might look something like:

#!/bin/bash
TODEL=$1
TRASH=/tmp
if [ -f $TRASH/$TODEL ];then
   OLDDATE=`date -r $TRASH/$TODEL +"%Y-%m-%d_%H%M%S"`
   mv $TRASH/$TODEL $TRASH/${TODEL}_${OLDDATE}
fi
mv $TODEL $TRASH

So - it first checks if there is a file in /tmp that has the same name as the file you are about to delete. If so, it renames it by appending the year, month, day, hour, minute, second to the file. This means you can actually go back several versions.

It then moves whatever file you are attempting to delete to the /tmp directory. Note that this in itself might be a security risk as you might be moving files from your private directories to a common shared directory.

Many operating systems have the concept of a trash folder that can be accessed from the GUI interface. You may prefer to modify the script above to put files into that directory (where ever it happens to be). On my Ubuntu system it is ~/.local/share/Trash/files/ On my Macintosh it is ~/.Trash

Andrew

[Stefan Wagner]

And backup often, so you may recover from your backup.

If you know some content of your file, you might use dd and grep to filter a whole partition, which might take a long, long time for todays harddrives.

I.e.:

dd if=/dev/sda1 bs=4096 | grep "secret, expensive information" 

would scan the first partition of the first drive on my linux-system, and scan the whole thing - deleted or not - for the text "secret, expensive information".