Win a copy of Learn Spring Security (video course) this week in the Spring forum!
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic

recovery after rm command

 
Minal Silimkar-Urankar
Ranch Hand
Posts: 136
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
In windows if we delete any file, it goes in recycle bean.
If we delete any file using rm command in unix where it goes?
How to recover that file?
 
Ernest Friedman-Hill
author and iconoclast
Marshal
Pie
Posts: 24208
35
Chrome Eclipse IDE Mac OS X
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
It doesn't go anywhere; it's deleted. The same thing happens in Windows if you use "del" from the command line.

Some of the file's data may be recoverable, but it's unlikely. It depends on what filesystem you're using, and how the system has been used since the file was deleted. If you're using ext2fs you may be able to recover your file; see here. It's some major dark magic, though; if you're not a Linux wizard it's unlikely you'll be able to do it. If you're using the more modern ext3fs, you're pretty much completely out of luck.

Sorry for the bad news.
 
Minal Silimkar-Urankar
Ranch Hand
Posts: 136
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator

Originally posted by Ernest Friedman-Hill

Sorry for the bad news.


Ernest Friedman, whatever information you have given is not at all a bad news, but at least you showed me a way


Some of the file's data may be recoverable, but it's unlikely. It depends on what filesystem you're using, and how the system has been used since the file was deleted. If you're using ext2fs you may be able to recover your file;


Is it applicable operating system’s like Solaris, HPUX, AIX?
 
Ernest Friedman-Hill
author and iconoclast
Marshal
Pie
Posts: 24208
35
Chrome Eclipse IDE Mac OS X
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Every UNIX OS supports one or more filesystem types, often specific to that OS. For the original UNIX filesystems, the answer was always what I've given here. There's certainly a chance, though, that these days one or more of these other UNIX flavors might offer a filesystem that allows file undelete -- I just don't personally know of one. I have to confess I don't have detailed knowledge of current AIX, Solaris, or HP-UX features.
 
Minal Silimkar-Urankar
Ranch Hand
Posts: 136
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
I know about rm command is, if we delete any file it permanently deletes inode number from inode file table. Is there any chance of storing reference or getting reference of deleted file?
 
Andrew Monkhouse
author and jackaroo
Marshal Commander
Pie
Posts: 11851
185
C++ Firefox Browser IntelliJ IDE Java Mac Oracle
  • Likes 1
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
If you are talking about storing a reference to a deleted file, I assume you are talking about trying to protect yourself from deleting a file by accident in the future. If so, then a simple solution might be creating a deletion script then aliasing your rm command to point to it. Something like:



Where the deleteFile script might look something like:



So - it first checks if there is a file in /tmp that has the same name as the file you are about to delete. If so, it renames it by appending the year, month, day, hour, minute, second to the file. This means you can actually go back several versions.

It then moves whatever file you are attempting to delete to the /tmp directory. Note that this in itself might be a security risk as you might be moving files from your private directories to a common shared directory.

Many operating systems have the concept of a trash folder that can be accessed from the GUI interface. You may prefer to modify the script above to put files into that directory (where ever it happens to be). On my Ubuntu system it is ~/.local/share/Trash/files/ On my Macintosh it is ~/.Trash

Andrew
 
Stefan Wagner
Ranch Hand
Posts: 1923
Linux Postgres Database Scala
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
And backup often, so you may recover from your backup.

If you know some content of your file, you might use dd and grep to filter a whole partition, which might take a long, long time for todays harddrives.

I.e.:
would scan the first partition of the first drive on my linux-system, and scan the whole thing - deleted or not - for the text "secret, expensive information".
 
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic