Recovering files in Linux

Imagine, you have been working for days on these files, it's your masterpiece. OK now, just delete these vi backups before releasing it... you type:

rm ~ *

Oh nooooooooooooo, your fingers slipped and touched the spacebar. All you files are gone!!!! What should you do? Commit suicide, harakiri? No, it might still be possible to recover some files...

In order to undelete a file, you must know the following things:

• On which device your file was stored
• What kind of file system was used (eg. ext2, reiserFS, vfat)

To find it out, type 'mount | column -t' in the shell, or to make it evan more easy, copy-paste or type this into your shell:

echo "DEVICE DIRECTORY FS-TYPE" > tmp; mount | cut -d" " -f1,3,5 | \
sort >> tmp; cat tmp | column -t | sed -e "1s/.*/`tput smso`&`tput rmso`/"

The output should be something like this:

bash$ mount | column -t
/dev/hda5  on  /               type  ext2      (rw)
proc       on  /proc           type  proc      (rw)
usbdevfs   on  /proc/bus/usb   type  usbdevfs  (rw)
devpts     on  /dev/pts        type  devpts    (rw)
/dev/hda1  on  /mnt/windows/C  type  vfat      (rw,noexec,nosuid,nodev)
/dev/hda6  on  /mnt/windows/E  type  vfat      (rw,noexec,nosuid,nodev)
/dev/hdc5  on  /mnt/oldwin     type  vfat      (rw,noexec,nosuid,nodev)

bash$ echo "DEVICE DIRECTORY FS-TYPE" > tmp; mount | cut -d" " -f1,3,5 | \
sort >> tmp; cat tmp | column -t | sed -e "1s/.*/`tput smso`&`tput rmso`/"
DEVICE     DIRECTORY       FS-TYPE
/dev/hda1  /mnt/windows/C  vfat
/dev/hda5  /               ext2
/dev/hda6  /mnt/windows/E  vfat
/dev/hdc5  /mnt/oldwin     vfat
devpts     /dev/pts        devpts
proc       /proc           proc
usbdevfs   /proc/bus/usb   usbdevfs

Now, of which (printed) directory was the directory of your deleted file a subdirectory? E.g. if your file was stored on /home/user , you'll have to look for '/', since no closer match can be found. Found it? Cool, right now it's a piece of cake to find the device on which the file was stored and the filesystem type of the device.

Ok, now you know the essentials to undelete a file. This can be done in several ways:

• If the filesystem is ext2:
  • recover
  • Midnight Commander
• Not ext2:
  • Read your file-system's manual
  • The unix way

I hope this helps. If you need more help, try searching google for more info. Good luck!