PebHmong Discussion Forum
Hobbies & Interests => Computer & Technology => Topic started by: celi on January 24, 2012, 09:28:33 AM
-
can someone help provide me the command to retrieve a deleted file from root other than doing a restore on backup or using other utilities?
-
can someone help provide me the command to retrieve a deleted file from root other than doing a restore on backup or using other utilities?
I don't think there's such a command.
If you happened to place the file in the trash and didn't empty the trash, you can get it back.
-
tetrapod..
i'm looking to see if anyone here can help come up with a shell command (in linux) to retrieve a file that has been removed with rm -i * other than having to do a restore on the data or by using other utilities.
-
tetrapod..
i'm looking to see if anyone here can help come up with a shell command (in linux) to retrieve a file that has been removed with rm -i * other than having to do a restore on the data or by using other utilities.
I see. You have a backup copy of the file?
then just copy the file from the back drive.
for example:
cp /media/backup/myfile/file.txt /home/myhome/
-
Depth of recovery depends on the file system you are using. Even with ext2 or fat, if the file has been overwritten you may be out of luck. Obviously, if it's life or death money will probably show you the way. ;D
-
@ tetrapod: thx but i wanna recover/retrieve the deleted file w/out having to use the "backup file".
@tubyaj: i understand once you remove <delete> a file in shell command, it's really gone but i'm sure there's a way around to retrieving it back w/out having to physically do a file backup.
-
@ tetrapod: thx but i wanna recover/retrieve the deleted file w/out having to use the "backup file".
@tubyaj: i understand once you remove <delete> a file in shell command, it's really gone but i'm sure there's a way around to retrieving it back w/out having to physically do a file backup.
There's no such option. Maybe there might be third party tools that can do that but a plain linux installation does not have support for recovering a deleted file. You will have to make a copy from the backup. That's actually very easy to do.
-
Yeah...like Tetrapod stated, there is no one simple command. Once you do a rm command it removes the hard link, depending on the file system, and this means the data will eventually get overwritten. Recovery software just tries to find the bits and pieces and make it whole. If you have backups just go that route.
-
There's no such option. Maybe there might be third party tools that can do that but a plain linux installation does not have support for recovering a deleted file. You will have to make a copy from the backup. That's actually very easy to do.
lol.. i know and i understand there's no such option but i'm sure there's got to be a way around this... somehow :-\
remember i say, not with the use of third party tools or having to make backups. (just hardcore shell commands) :)
-
lol.. i know and i understand there's no such option but i'm sure there's got to be a way around this... somehow :-\
remember i say, not with the use of third party tools or having to make backups. (just hardcore shell commands) :)
All the time you spent searching for an answer, you could have copy the file from the back drive over hundreds of time. :)
-
All the time you spent searching for an answer, you could have copy the file from the back drive over hundreds of time. :)
lol.. i had to restore it from my bkup copy some minutes later..but it would be so much convenience if it was just a shell command away...
you guys are pretty smart, i'm sure one of u will find a way to go around this.. and if you guys do. pls share ur knowledge ok :-*
-
lol.. i had to restore it from my bkup copy some minutes later..but it would be so much convenience if it was just a shell command away...
you guys are pretty smart, i'm sure one of u will find a way to go around this.. and if you guys do. pls share ur knowledge ok :-*
in that case, it makes more sense to write a wrapper for rm that puts the file in a .deleted folder. In the .deleted folder, there is a file that contains the original path of the file, and the to be deleted file. User can restore by rm -restore /home/myhome/myfile.txt and it will move the file from .delete to /home/myhome/myfile.txt. You then have a crone job that delete very old files from your .deleted folder at the end of every week. There is really no other better option I can think off.
-
In short, move over to Gates domain. ;D
in that case, it makes more sense to write a wrapper for rm that puts the file in a .deleted folder. In the .deleted folder, there is a file that contains the original path of the file, and the to be deleted file. User can restore by rm -restore /home/myhome/myfile.txt and it will move the file from .delete to /home/myhome/myfile.txt. You then have a crone job that delete very old files from your .deleted folder at the end of every week. There is really no other better option I can think off.
-
In short, move over to Gates domain. ;D
What's that?
-
There is no shell cmd to recover. All recovery programs do a search for file headers and attempt to restore.
-- so after several weeks of pondering... I have figured out how to recover a deleted file on linux by just using command lines.
i thought about writing a perl script to excute it from linux but that was too much work.
anyhow, good news..
lsof is a Linux tool which can show open files and network connections, and even recover deleted files!!!!
more info on lsof >>> http://www.catonmat.net/blog/unix-utilities-lsof
http://linux.about.com/library/cmd/blcmdl8_lsof.htm
1) $ lsof | grep datafile.txt
this will output something like ....xxxx 32140 servername 56w xxx ##,# #### / log folder/datafile.txt (deleted)
the32140 is the process that still has the file open and without this process keeping the file open, then the file is lost permanently, hence the process id 32140 and finally look for the file descriptor (fd) which is the 56 (of course this will be different)
Also the idea is to look for the word "deleted"
2) $ cat /dev/32140/fd/56
this outputs the contents of the deleted datafile.txt, which the data is still there so all you need is to redirect the contents back to your directory/original file like this:
3) $ cat /dev/32140/fd/56 > /datalogs/datafile.txt
and whoola.. you have just recovered your datafile.txt with all the data back to its original location.
-
that seems to work for text files only. I am unsure if there is a command to restore files other than text. I know they are utilities, free and paid, to retrieve the deleted files.
-
@least we're still able to retrieve files once deleted from Linux where many if not all says there's no way.
just 3 line of command to retrieve a deleted files (text/logs etc).. I am thinking as long as the files has not been fully overwritten this method should work for other files.
i know there are free/unpaid utilities but I was trying to avoid all that along the manual restore (backup of the original files) all together :)
-
thanks for the info. it's unlikely i will ever use but at least I can mention that there's such a free tool.
-
-- so after several weeks of pondering... I have figured out how to recover a deleted file on linux by just using command lines.
i thought about writing a perl script to excute it from linux but that was too much work.
anyhow, good news..
lsof is a Linux tool which can show open files and network connections, and even recover deleted files!!!!
more info on lsof >>> http://www.catonmat.net/blog/unix-utilities-lsof
http://linux.about.com/library/cmd/blcmdl8_lsof.htm
1) $ lsof | grep datafile.txt
this will output something like ....xxxx 32140 servername 56w xxx ##,# #### / log folder/datafile.txt (deleted)
the32140 is the process that still has the file open and without this process keeping the file open, then the file is lost permanently, hence the process id 32140 and finally look for the file descriptor (fd) which is the 56 (of course this will be different)
Also the idea is to look for the word "deleted"
2) $ cat /dev/32140/fd/56
this outputs the contents of the deleted datafile.txt, which the data is still there so all you need is to redirect the contents back to your directory/original file like this:
3) $ cat /dev/32140/fd/56 > /datalogs/datafile.txt
and whoola.. you have just recovered your datafile.txt with all the data back to its original location.
I finally get to play with lsof on a Mac. On the mac, it seems files are closed right away when done. After creating a file and closing it, lsof doesn't show it. If I open it in vi and run lsof, then it shows the file being opened. If I deleted the file and then run lsof, it doesn't show it. I sense that what you are doing is just copying the cache of the file that Linux keeps and it would be gone if the computer is rebooted or if Linux get to close the file to reclaim resources.
Might as well write a wrapper for rm command that keeps a cache of the file for up to a week before a crone job deleted the file which would be a better solution than hoping the file is still in cache.
-
I finally get to play with lsof on a Mac. On the mac, it seems files are closed right away when done. After creating a file and closing it, lsof doesn't show it. If I open it in vi and run lsof, then it shows the file being opened. If I deleted the file and then run lsof, it doesn't show it. I sense that what you are doing is just copying the cache of the file that Linux keeps and it would be gone if the computer is rebooted or if Linux get to close the file to reclaim resources.
Might as well write a wrapper for rm command that keeps a cache of the file for up to a week before a crone job deleted the file which would be a better solution than hoping the file is still in cache.
Oh cool! I'm glad you gave this a try. you are correct, however i did say: the32140 is the process that still has the file open and without this process keeping the file open, then the file is lost permanently
kudos O0 +1
-
Depth of recovery depends on the file system you are using. Even with ext2 or fat, if the file has been overwritten you may be out of luck. Obviously, if it's life or death money will probably show you the way. ;D
How to you backup exclude folders? I have lots files within folder and I want exclude the folders when do a cmd backup.
-
taking a shot here:
maybe try:
# tar cvfp mytarball.tar /mypath/Example.com_DIR --exclude=/mypath/Example.com_DIR/images
Tar everything in the current directory but exclude two files
# tar cvpf mytar.tar * --exclude=index.html --exclude=myimage.png