On Mon, Mar 31, 2003 at 12:06:06AM -0500, Jeremiah Foster wrote: > I have foolishly deleted a file I did not want to. > It was created this morning, so it is not backed up. > > is there an undelete util ? i've definitely been in these shoes before. it may be too late depending on how active your filesystem is. here's what i'd try, fingers crossed. a - unmount the filesystem!!! if it's at all possible, unmount it, stop writing to it! you can also remount it read-only if you must. if you can't do that (like if it's in /var or something), boot up from a floppy disk or knoppix cd or something. once you're able to do this, you can take a deep breath, because if it's safe, it will now stay safe, and if it's not, then it's already gone and you can't do anything about it. b - read up on documentation for debugfs. when you delete a file, it's contents aren't actually deleted (that'd be a waste of cpu and disk access), instead, the inodes for your files are simply returned to a pool of "deleted" inodes, which may at some point be used again for another file (after which, you're basically SOL if you don't have 5 digits to spend and a professional cpu forensics lab) if you're lucky though, these inodes have remained undisturbed, and you can get them back with debugfs. i won't go into the details of the program, but it comes with some good documentation and googling should fill in the rest of the blanks. you should be able to use it to get a list of deleted inodes, which you can then dump to another filesystem, which you can then grep for your precious data. good luck... sean
Attachment:
pgp6ZqWW_95VX.pgp
Description: PGP signature