Recovering deleted files using grep

sp332 wrote: post #4

Make sure your output file is on a different filesystem! Otherwise, it might be saved in the newly-freed blocks of the file you're trying to recover.

Better yet, mount the hard drive read-only (on a different computer if necessary).

Re: Recovering deleted files using grep

#6

Post by Wilfred » Thu, Aug 19, 2010, 6:45 PM UTC

sp332 wrote: post #4

Make sure your output file is on a different filesystem! Otherwise, it might be saved in the newly-freed blocks of the file you're trying to recover.

The author's intent is to write enough of the surrounding context that you recover it first time.

Still, it raises two questions:

What about fragmentation?

Why don't have a GNU safe-rm yet that moves files to the (freedesktop.org specified) trash location to avoid this?

Re: Recovering deleted files using grep

#7

Post by tbrownaw » Thu, Aug 19, 2010, 6:47 PM UTC

    cat /dev/mem | strings | grep -i llama

Re: Recovering deleted files using grep

#8

Post by someone_here » Thu, Aug 19, 2010, 6:48 PM UTC

tbrownaw wrote: post #7

cat /dev/mem | strings | grep -i llama

My memory is full of llamas!

Re: Recovering deleted files using grep

#9

Post by someone_here » Thu, Aug 19, 2010, 6:51 PM UTC

Wilfred wrote: post #6

sp332 wrote: post #4

Make sure your output file is on a different filesystem! Otherwise, it might be saved in the newly-freed blocks of the file you're trying to recover.

The author's intent is to write enough of the surrounding context that you recover it first time. Still, it raises two questions: What about fragmentation? Why don't have a GNU safe-rm yet that moves files to the (freedesktop.org specified) trash location to avoid this?

Because you told it to remove the file instead of moving the file? I don't see why we need a safe-rm on the command line.

File managers already implement a trash function as per the freedesktop.org spec: http://www.ramendik.ru/docs/trashspec.html

Re: Recovering deleted files using grep

#10

Post by barrkel » Thu, Aug 19, 2010, 7:06 PM UTC

Wilfred wrote: post #6

sp332 wrote: post #4

Make sure your output file is on a different filesystem! Otherwise, it might be saved in the newly-freed blocks of the file you're trying to recover.

The author's intent is to write enough of the surrounding context that you recover it first time. Still, it raises two questions: What about fragmentation? Why don't have a GNU safe-rm yet that moves files to the (freedesktop.org specified) trash location to avoid this?

I never bother with "safe" deletion even on the desktop (Windows 7); I don't even have deletion prompts. For the once or twice a year that something gets mistakenly deleted - or more likely, overwritten - restore from backup does nicely.

Assuming you have backups, of course. Which you'd be insane not to.