Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations gkittelson on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
S**T I have deleted a file.
- Thread starter sirrom
- Start date
Guest_imported
New member
- Jan 1, 1970
- 0
sirrom,
It may be possible. If you recall that when a uxix file is removed/deleted from the disk the inodes are NOT. They're only marked as FREE. The actual data contained in the files is still on disk and can potentially be retrieved before being over-written. It's important to put your file system in a safe/read-only state to prevent the file from being over written. Then use dd to copy the file system (not just your home directory) to a file:
dd if=/dev/dsk/c0t0d0s1 of=/export/recovery.txt
Then try to find out which entries are out there by:
cat -n /export/recovery.txt | fgrep "something inside the file"
200214 #!/bin/sh something inside the file
345678 # This is my deleted file something inside the file
123456 something inside the file
If this returns something, then you're in good shape. If not then try to look for something else that is unique inside the file. It's easier if you have something on the first line but it isn't critical.
Now comes the tricky part. The easiest method is by using the GNU version of grep which allows for a certain number of lines before/after a match to be displayed. Or you can check out seekcat.
Example:
fgrep -A 10 "something inside the file" /export/recover.txt > recoveredfile.txt
Where 10 is the number of lines to grab after the text (-B = # lines before text)
If there is more than one occasion you will have to clean up the recoveredfile.txt to get your file back to its original form.
Good luck.
It may be possible. If you recall that when a uxix file is removed/deleted from the disk the inodes are NOT. They're only marked as FREE. The actual data contained in the files is still on disk and can potentially be retrieved before being over-written. It's important to put your file system in a safe/read-only state to prevent the file from being over written. Then use dd to copy the file system (not just your home directory) to a file:
dd if=/dev/dsk/c0t0d0s1 of=/export/recovery.txt
Then try to find out which entries are out there by:
cat -n /export/recovery.txt | fgrep "something inside the file"
200214 #!/bin/sh something inside the file
345678 # This is my deleted file something inside the file
123456 something inside the file
If this returns something, then you're in good shape. If not then try to look for something else that is unique inside the file. It's easier if you have something on the first line but it isn't critical.
Now comes the tricky part. The easiest method is by using the GNU version of grep which allows for a certain number of lines before/after a match to be displayed. Or you can check out seekcat.
Example:
fgrep -A 10 "something inside the file" /export/recover.txt > recoveredfile.txt
Where 10 is the number of lines to grab after the text (-B = # lines before text)
If there is more than one occasion you will have to clean up the recoveredfile.txt to get your file back to its original form.
Good luck.
- Status
Similar threads
- Locked
- Question