Recovering deleted files using only grep • Hacker News Board

Re: Recovering deleted files using only grep

#41

Post by LukeShu » Thu, Jun 26, 2014, 2:07 AM UTC

aquadrop wrote: post #35

snori74 wrote: post #23

Earlier quoted context omitted.

Indeed. The whole "never run rm -rf " thing is so ingrained that someone I know took real joy in finally getting to legitimately use this to nuke an old server once the new one was signed off. Pity he'd not considered that the old one had nfs mounts to the live data...

I think 'rm -rf /' shouldn't work and there should be special command instead of 'rm -rf /', something like rmrfhell, which would ask you three times if you sure and will tell you about pain and tears of other people who ran it.

In the GNU version, that mostly is the case. You need to specify `--no-preserve-root` for it to work, which is obscure enough.

Re: Recovering deleted files using only grep

#42

Post by vacri » Thu, Jun 26, 2014, 6:30 AM UTC

phpdreams wrote: post #16

Silhouette wrote: post #15

Earlier quoted context omitted.

Also a very important lesson regarding the dangers of poor user interface design. It's a little bit crazy that in 2014 we still have a significant amount of serious work being done on systems where a slip of the finger or a one-character typo in a script can literally destroy whole systems with no confirmation and no reliable recovery mechanism.

This is why every system I administer has 'rm' aliased to 'rm -i' (along with 'cp' and 'mv' just in case). I believe this is the default on RHEL/CentOS boxes. Certainly for root, but should be for every user. Sure, it can be a pain sometimes to have to confirm, but at least you get the chance....unless you add '-f'.

Looking at the man page now, there is now a -I option, which asks only once per 3 removals.

Re: Recovering deleted files using only grep

#43

Post by davidgerard » Thu, Jun 26, 2014, 10:40 AM UTC

mpweiher wrote: post #14

We used to do free-space scanning on our PDP-11. Disk blocks were not cleared, so you could just open a very large temporary file and look through it. Actually recovered quite a few people's homework assignments that way. Of course, you could also write to that file, so we had free-space sweepers. And since you could write to that empty space, you could also leave messages, even from the public (100,0) account, which…

Yeah, I did that too. Was fun!

Re: Recovering deleted files using only grep

#44

Post by blueskin_ » Thu, Jun 26, 2014, 3:12 PM UTC

aquadrop wrote: post #35

snori74 wrote: post #23

Earlier quoted context omitted.

Indeed. The whole "never run rm -rf " thing is so ingrained that someone I know took real joy in finally getting to legitimately use this to nuke an old server once the new one was signed off. Pity he'd not considered that the old one had nfs mounts to the live data...

I think 'rm -rf /' shouldn't work and there should be special command instead of 'rm -rf /', something like rmrfhell, which would ask you three times if you sure and will tell you about pain and tears of other people who ran it.

Most versions have --preserve-root (fail if the target is /) on by default, so you have to use --no-preserve-root , although rm -rf /* will still work.

Re: Recovering deleted files using only grep

#45

Post by madaxe_again » Mon, Jun 30, 2014, 10:47 AM UTC

amckenna wrote: post #12

madaxe_again wrote: post #11

Yeah, been there, done that, although my first step is to umount and dd onto another volume so the sectors don't get reallocated and obliterate the data - and that's generally a sane first step for ANY recovery of this ilk. You haven't lived until you unwittingly run rm -rf on a nfs mount of / on a remote box. Which happens to be the fileserver for a trading shop. In the middle of trading hours.

What did you do in that case?

1) Panic.

2) Run to comms room and yank out power cord.

3) Spend several days piecing files back together from backups and the remnant data on disk.

4) Learned a new respect for rm.

Re: Recovering deleted files using only grep

#46

Post by lotheac » Sun, Jul 06, 2014, 5:17 PM UTC

gizmo686 wrote: post #28

lotheac wrote: post #27

Earlier quoted context omitted.

> Automatically take a snapshot every 5 minutes, and present a the user a program that broweses the filesystem at time X, probably with integration into the filemanager to restore files/folders. Something like this? http://java.dzone.com/news/killer-feature-opensolaris-200

That sounds like it is doing something fancier then periodic snapshotting, such as using an immutable filesystem, where every fs operation is inherently lossless (up to garbage collection). Of course, I might be reading to much into the continous nature of a slider. Does anyone have experience with that feature?

(Sorry for the late reply)

In OpenSolaris it just used cronjobs to create zfs snapshots.