LinuxDevCenter.com
oreilly.comSafari Books Online.Conferences.

FAQS
 FAQs
Apache FAQ
Linux FAQ
XML FAQ

Log in to particpate






   Linux FAQ > 5. File Systems, Disks, and Drives
Question:  5.2. How To Undelete Files.
Answer:

In general, this is very hard to do on unices because of their multitasking nature. Undelete functionality for the ext2fs file system is being worked on, but don't hold your breath.

There are a number of packages available which instead provide new commands for deleting and copying which move deleted files into a `wastebasket' directory. The files can be recovered until cleaned out automatically by background processing.

The Midnight Commander file manager provides an undelete facility that uses Ext2 file system library functions and an undelete directory for each file system. Commercial distribution packages of MC may or may not have this feature enabled, so be sure to look in the source code distribution for instructions on how to enable the undelete feature.

Alternatively, you can search the raw disk device which holds the file system in question. This is hard work, and you will need to be logged in as root to do this. But it can be done. Run grep on the raw device; e.g.:

   grep -b 'bookmarks' /dev/hda


If the data has not been overwritten, you should be able to recover it with a text editor.

[Dave Cinege, Daniel Novotny]


This FAQ is from Linux Frequently Asked Questions with Answers, maintained by Robert Kiesling

Sponsored by: