Arch Linux

ironwiller

Member

Registered: 2007-07-09

Posts: 69

undelete a deleted file?

hi. i delete byt mistake another file than i want to. by using shift + delete. is there any way that i can get it back? or its gone? (filesystem if it is matter ext3)

ThomasAdam

Member

From: Southampton, England

Registered: 2005-10-26

Posts: 149

Re: undelete a deleted file?

Using what?  Some graphical file mangers sometimes put files into a Trash bin before they're deleted.  Otherwise, no, there's no way to recover your lost file.

-- Thomas Adam

ironwiller

Member

Registered: 2007-07-09

Posts: 69

Re: undelete a deleted file?

Using what?  Some graphical file mangers sometimes put files into a Trash bin before they're deleted.  Otherwise, no, there's no way to recover your lost file.

-- Thomas Adam

using konqueror

nope unfornately its not in trash, and either in secret files /.local/.../trash

is there any script that i can search for it. i know the specific name of the file.

sniffles

Member

Registered: 2008-01-23

Posts: 275

Re: undelete a deleted file?

Otherwise, no, there's no way to recover your lost file.

Are you 100% sure?

ironwiller:

Give a man a fish and you feed him for a day. Teach a man to fish and you feed him for a lifetime.
Build a man a fire, and he'll be warm for a day. Set a man on fire, and he'll be warm for the rest of his life.

It being an ext3 filesystem *does* matter. I've done a simple google search regarding your problem which pointed me to various resources which provided various ways to (in some cases -- i.e. "s**t loads of luck" cases) recover the file. Give it a shot.

Last edited by sniffles (2008-06-15 21:13:02)

ironwiller

Member

Registered: 2007-07-09

Posts: 69

Re: undelete a deleted file?

Otherwise, no, there's no way to recover your lost file.

Are you 100% sure?

ironwiller:

Give a man a fish and you feed him for a day. Teach a man to fish and you feed him for a lifetime.
Build a man a fire, and he'll be warm for a day. Set a man on fire, and he'll be warm for the rest of his life.

It being an ext3 filesystem *does* matter. I've done a simple google search regarding your problem which pointed me to various resources which provided various ways to (in some cases -- i.e. "s**t loads of luck" cases) recover the file. Give it a shot.

i agree with the quote, can you give me the key-words that you put in search? because i dont know much i just put recovery file archlinux. what should i put?

ThomasAdam

Member

From: Southampton, England

Registered: 2005-10-26

Posts: 149

Re: undelete a deleted file?

Otherwise, no, there's no way to recover your lost file.

Are you 100% sure?

Presuming you immediately don't clober the inode, make sure nothing else writes to the disk afterwards, the journal doesn't corrup, you can use grep, od, sed and a hex editor, then yes, I am sure.

The timing is critical, so it's too late.

-- Thomas Adam

MilosC

Member

From: Serbia

Registered: 2008-06-04

Posts: 79

Re: undelete a deleted file?

Hey, try this stuff: http://www.cgsecurity.org/wiki/PhotoRec

ozar

Member

From: USA

Registered: 2005-02-18

Posts: 1,686

Re: undelete a deleted file?

If the file is really important, definitely give PhotoRec a go, because it can recover lots of file types other than photo extensions.

---

oz

ironwiller

Member

Registered: 2007-07-09

Posts: 69

Re: undelete a deleted file?

If the file is really important, definitely give PhotoRec a go, because it can recover lots of file types other than photo extensions.

its an .ogv file

i ve install testdisk and photorec (actually was together) i need one example so i can understand how i have to do it. cause i dont get it with the instruction (sorry new guy )

Q: ex: i have the recording.ogg-2.ogv in the folder /home/user/

how am i supposed to do it exaclty so i can recover it?

photorec /home/user/ recording.ogg-2.ogv ?

i tried it it says "Unable to open file or device recording.ogg-2.ogv"

tried photrec recording.ogg-2.ogv

came the same "Unable to open file or device recording.ogg-2.ogv"

what should i write exactly?

ty

schivmeister

Developer/TU

From: Singapore

Registered: 2007-05-17

Posts: 971

Website

Re: undelete a deleted file?

Shift+delete is the same as rm. It gets rid of the file, and gets the inode ready for overwrite.

PhotoRec and TestDisk are not "straightforward". Any kind of recovery tool is not. This kind of recovery is expensive too, if you take it over for professional servicing. So the best way now is to read a photorec tutorial. Basically it will recover thousands of files, from back when you were born. You then need to sort things out, usually with scripts. It's one big mess, so something like

find ~/recovery/everything -type f | while read i; do file -b "$i" | grep "video:" > /dev/null && install -m0644 "$i" ~/recovery/files/"$i"; done

may be able to do it. It's painfully slow so you may prefer to have it do ls -1 instead of find for every dir, and please include a better matching pattern than just "video:" since I don't have a .ogv to check. I hope your /home is on a separate partition. You should unmount it also. If it's on /, good luck (on the huge amount of files and number of hours it will take).

---

I need real, proper pen and paper for this.

ironwiller

Member

Registered: 2007-07-09

Posts: 69

Re: undelete a deleted file?

Shift+delete is the same as rm. It gets rid of the file, and gets the inode ready for overwrite.

PhotoRec and TestDisk are not "straightforward". Any kind of recovery tool is not. This kind of recovery is expensive too, if you take it over for professional servicing. So the best way now is to read a photorec tutorial. Basically it will recover thousands of files, from back when you were born. You then need to sort things out, usually with scripts. It's one big mess, so something like

find ~/recovery/everything -type f | while read i; do file -b "$i" | grep "video:" > /dev/null && install -m0644 "$i" ~/recovery/files/"$i"; done

may be able to do it. It's painfully slow so you may prefer to have it do ls -1 instead of find for every dir, and please include a better matching pattern than just "video:" since I don't have a .ogv to check. I hope your /home is on a separate partition. You should unmount it also. If it's on /, good luck (on the huge amount of files and number of hours it will take).

ok....ty for the info and the save of time....i will let the file to rest... lol