linux.. restore file ..

[jetter]

that seems to work for text files only.  I am unsure if there is a command to restore files other than text.  I know they are utilities, free and paid, to retrieve the deleted files.

[celi]

@least we're still able to retrieve files once deleted from Linux where many if not all says there's no way.
just 3 line of command to retrieve a deleted files (text/logs etc).. I am thinking as long as the files has not been fully overwritten this method should work for other files.

i know there are free/unpaid utilities but I was trying to avoid all that along the manual restore (backup of the original files) all together

[tetrapod]

thanks for the info.  it's unlikely i will ever use but at least I can mention that there's such a free tool.

[tetrapod]

-- so after several weeks of pondering... I have figured out how to recover a deleted file on linux by just using command lines.
i thought about writing a perl script to excute it from linux but that was too much work.

anyhow, good news..

lsof is a Linux tool which can show open files and network connections, and even recover deleted files!!!!
more  info on lsof >>>  http://www.catonmat.net/blog/unix-utilities-lsof
http://linux.about.com/library/cmd/blcmdl8_lsof.htm

1) $ lsof | grep datafile.txt
this will output something like ....xxxx 32140 servername 56w xxx ##,# #### / log folder/datafile.txt (deleted)

the32140 is the process that still has the file open and without this process keeping the file open, then the file is lost permanently, hence the process id 32140 and finally look for the file descriptor (fd) which is the 56 (of course this will be different)

Also the idea is to look for the word "deleted"

2) $ cat /dev/32140/fd/56
this outputs the contents of the deleted datafile.txt, which the data is still there so all you need is to redirect the contents back to your directory/original file like this:

3) $ cat /dev/32140/fd/56 > /datalogs/datafile.txt

and whoola.. you have just recovered your datafile.txt with all the data back to its original location.

I finally get to play with lsof on a Mac.  On the mac, it seems files are closed right away when done.  After creating a file and closing it, lsof doesn't show it.  If I open it in vi and run lsof, then it shows the file being opened.  If I deleted the file and then run lsof, it doesn't show it.  I sense that what you are doing is just copying the cache of the file that Linux keeps and it would be gone if the computer is rebooted or if Linux get to close the file to reclaim resources.

Might as well write a wrapper for rm command that keeps a cache of the file for up to a week before a crone job deleted the file which would be a better solution than hoping the file is still in cache. 

[celi]

I finally get to play with lsof on a Mac.  On the mac, it seems files are closed right away when done.  After creating a file and closing it, lsof doesn't show it.  If I open it in vi and run lsof, then it shows the file being opened.  If I deleted the file and then run lsof, it doesn't show it.  I sense that what you are doing is just copying the cache of the file that Linux keeps and it would be gone if the computer is rebooted or if Linux get to close the file to reclaim resources.

Might as well write a wrapper for rm command that keeps a cache of the file for up to a week before a crone job deleted the file which would be a better solution than hoping the file is still in cache.  

Oh cool! I'm glad you gave this a try. you are correct, however i did say:

the32140 is the process that still has the file open and without this process keeping the file open, then the file is lost permanently

kudos   +1

[jsstripler]

Depth of recovery depends on the file system you are using.  Even with ext2 or fat, if the file has been overwritten you may be out of luck.  Obviously, if it's life or death money will probably show you the way.

How to you backup exclude folders?  I have lots files within folder and I want exclude the folders when do a cmd backup.

[celi]

taking a shot here:

maybe try:
# tar cvfp mytarball.tar /mypath/Example.com_DIR --exclude=/mypath/Example.com_DIR/images

Tar everything in the current directory but exclude two files

# tar cvpf mytar.tar * --exclude=index.html --exclude=myimage.png