How To Undelete Files

In general, this is very hard to do on unices because of their
multitasking nature. Undelete functionality for the ext2fs file system
is being worked on, but don't hold your breath.

There are a number of packages available which instead provide new
commands for deleting and copying which move deleted files into a
`wastebasket' directory. The files can be recovered until cleaned out
automatically by background processing.

The Midnight Commander file manager provides an undelete facility that
uses Ext2 file system library functions and an undelete directory for
each file system. Commercial distribution packages of MC may or may
not have this feature enabled, so be sure to look in the source code
distribution for instructions on how to enable the undelete feature.

Alternatively, you can search the raw disk device which holds the file
system in question. This is hard work, and you will need to be logged
in as root to do this. But it can be done. Run grep on the raw device;
e.g.:

grep -b 'bookmarks' /dev/hda

If the data has not been overwritten, you should be able to recover it
with a text editor.

[Dave Cinege, Daniel Novotny]



UNIXguide.net
Suggest a Site