[CentOS] undelete

Thu Aug 10 14:59:07 UTC 2006
Will McDonald <wmcdonald at gmail.com>

On 08/08/06, Jerry Geis <geisj at pagestation.com> wrote:
> I just removed a bunch of Personal stuff I should not have.
> Is there anyway to undelete???

Jumping in late here, I recalled this snippet from NTK a few months back...

                  >> TRACKING <<
              sufficiently advanced technology : the gathering

        If you want to be truly loved, write a data recovery utility.
        We can't imagine there's a day when Christophe Grenier isn't
        swathed by offers of beers, steak dinners and marriage for
        TESTDISK and PHOTOREC, his two open source disk and file
        recovery utilities. The test TestDisk gives is sort of a final
        exam for your futzed partition block, quizzing your unreadable
        drive for tell-tale NTFS, HFS+, Ext3 or what-have-you data,
        and cribbing the lost partition data from what it finds.
        PHOTOREC gives up on such fripperies as a filing system and
        instead grubs directly on the drive for file data, spotting
        beginnings for popular file formats and having a stab at where
        their ends might be hanging. PHOTOREC, as the name suggests,
        started as a utility for clawing back pictures from bit-rotten
        flash cards, but can now sniff out files from Ogg Vorbis to
        Microsoft Powerpoint. Both utilities will run on Mac, DOs,
        Windows, Linux, and probably vegetable oil for that matter.
        Forget about them for now - when you need them, you'll find
        them.
        http://www.cgsecurity.org/wiki/TestDisk_Download
            - though you'll waste an hour searching NTK for "olive oil"
        http://www.flickr.com/photos/manuelidades/113461346/
                  - voila! c'est un web deux point zero shot de screen

Photorec might help if you know what you're after. It's often worth
unmount a filesystem you've deleted stuff from and, if you have the
space, just dd-ing the whole partition to another filesystem somewhere
for later analysis. There's a good (if somewhat old) article on this
from Sys Admin Mag:

http://www.samag.com/documents/s=1441/sam0111b/0111b.htm

Will