Re: recover deleted file
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Sat, 16 Apr 2022 12:48:47 UTC
> Depends on the kind of file. > > You can always: > 1. reboot the system into single user mode, mount the fs readonly (important= > to not overwrite data you want to recover) > 2. dd the partition and into a file > 3. find the content of the deleted file in the dump > > I was able to recover a complete codebase i deleted accidentally that way a l= > ong time ago. > > Good luck > Michael If it was my personal laptop with an external disk/ stick, I would _immediately_ pull the USB cable out. If a personal PC I would _immediately_ turn power off. I would Not do an unmount or sync or processes kill or shutdown. Then I would reboot single user, fsck & mount only the partitions the data was Not on., dd the partition to recover, then fsck the partition & mount it, & go multi user, then I'd make a 2nd copy of the partition with data to recover & start exploration with eg fsdb man fsdb: SEE ALSO editline(3), fs(5), clri(8), fsck(8), /usr/ports/ { graphics/recoverjpeg, sysutils/ { autopsy, dd_rescue, ddrescue, fatback, ffs2recov, foremost, gpart, magicrescue, recoverdm, scan_ffs, sleuthkit, testdisk } }. If you work had been on text using vi, then vi -r might show a recovery, hint copy the original before running vi -r file , as sometimes pre recovery is better than after. various lost+found may have stuff in http://berklix.com/~jhs/bin/.sh/lslf PS personaly I hand run numerous rdist6 or rsync through the day, when editing important stuff. They run fast, as incremental update, so avoid losing all but the last short period in a day. Cheers, -- Julian Stacey http://berklix.com/jhs/ http://StolenVotes.UK Kill / remove Putin to stop him killing & provoking world war.