Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Recovering deleted files using grep

spin.atomicobject.com

Post reply on HN
Print view View original

11–20 of 48 posts

Re: Recovering deleted files using grep

#12

Post by cryptoz »

> To help prevent this problem from happening in the first place, many people elect to alias the rm command to a script which will move files to a temporary location, like a trash bin, instead of actually deleting them.

Whatever happened to backups?

To help prevent this problem...

KEEP A BACKUP.

Re: Recovering deleted files using grep

#13

Post by someone_here »

ramidarigaz wrote: post #11
tbrownaw wrote: post #7

cat /dev/mem | strings | grep -i llama

Hmm... I'm getting an error on that one. cat: /dev/mem: Operation not permitted Edit: even as root

If I recall correctly, that's a bug that is preset on a particular kernel from 6-9 months ago.

Re: Recovering deleted files using grep

#16

Post by fragmede »

If the file was on an ext3 filesystem, you can use ext3grep, written by Carlo Wood (http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html)

(Grepping your hard drive for file fragments is suggested in the ext3 FAQ - http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html)

Re: Recovering deleted files using grep

#17

Post by albertzeyer »

Via `reiserfsck --rebuild-tree`, you can also do that for ReiserFS partitions. Have worked very reliable for me. Only problem is that it doesn't always recover the filename and/or the directory structure (depending on how long it is ago that you have deleted it).

Re: Recovering deleted files using grep

#19

Post by moobot »

naturalized wrote: post #14

Or, if you want to really delete a file, use #shred filename command #man shred SHRED(1) User Commands SHRED(1) NAME shred - overwrite a file to hide its contents, and optionally delete it I especially like the -n option!

Except that shred is not guaranteed to work on many (most?) modern filesystems. From `man shred`:

       CAUTION: Note that shred relies on a very  important  assumption:  that
       the  file system overwrites data in place.  This is the traditional way
       to do things, but many modern file system designs do not  satisfy  this
       assumption.   The following are examples of file systems on which shred
       is not effective, or is not guaranteed to be effective in all file sys‐
       tem modes:

       * log-structured or journaled file systems, such as those supplied with
       AIX and Solaris (and JFS, ReiserFS, XFS, Ext3, etc.)

       * file systems that write redundant data and  carry  on  even  if  some
       writes fail, such as RAID-based file systems

       *  file  systems  that  make snapshots, such as Network Appliance's NFS
       server

       * file systems that cache in temporary locations, such as NFS version 3
       clients

Re: Recovering deleted files using grep

#20

Post by pcora »

albertzeyer wrote: post #18
retroafroman wrote: post #2

Excellent Linux hack. I hadn't ever heard this before.

It works on all systems where you have raw access to the disk. And it isn't really that fancy if you think about how it works and how file systems work.

Yup, it's not very fancy, but in the end, serves its purpose and can really save your work.

the last part, about using an alias for rm is something that I've never thought about it and now I'm gonna use always on my servers.

Post reply on HN