Sponsored Content
Operating Systems Linux Recover deleted files on Linux server Post 303025719 by bakunin on Saturday 10th of November 2018 10:26:26 AM
Old 11-10-2018
Quote:
Originally Posted by reminisce
Note: The directory was deleted with other use not root user.
That is irrelevant - dead is dead and deleted is deleted.

Quote:
Originally Posted by reminisce
In one of the youtube link ,the admin provided some steps to get back the lost files.


As first step, below command needs to be executed :
ps -aux | grep <filename>
As an output, I could find the file and process id .
That may help as long as the process is running: when a file is deleted the system routine unlink() is used, which deletes the inode (and thus every possibility to access the files data). As long as at least one process still has this file opened, though, the unlink() is postponed, so the process still can access the file even though "from outside" the file already ceases to exist.

This means, if you can somehow get "inside" the process in question and if you can bring the process to write the file (or, at least, its inode information) then you can use this to restore the file, otherwise it is lost.

You might have luck with trying TestDisk as long as you haven't done anything further on that filesystem. My suggestion is to unmount it as soon as possible (preferably: NOW!) because the longer it is in use the bigger the chance that data which are still there (but unaccessible right now) will be overwritten (=definitely and ultimately lost forever).

I hope this helps.

bakunin
 

8 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

Recover deleted files

Is there a Unix tool, like in Novell, to recover accidentally deleted files? (2 Replies)
Discussion started by: kuultak
2 Replies

2. AIX

recover deleted files

How to recover deleted files in AIX ? (1 Reply)
Discussion started by: vjm
1 Replies

3. Linux

recover deleted files from memory stick

I'm running Fedora Core4. I deleted images off of my Sony DSC-P73 digital camera's memory stick. I'm looking for a *nix tool to recover the photos from the memory stick. Does anyone know of such a tool? (2 Replies)
Discussion started by: dangral
2 Replies

4. Shell Programming and Scripting

Is there a way to recover files deleted using rm command???

Hi All, I just mistakingly deleted some files using rm command.Is there a way to get it back?i work on Solaris 10 Thanks, Kumar (1 Reply)
Discussion started by: kumarsaravana_s
1 Replies

5. UNIX for Dummies Questions & Answers

how to recover deleted files in unix

Hi Experts, by mistake i deleted some files that are very important to the project. is there any way that i can recover those files,there is no backup for that but the details of the file we know. This will be a great help. Thanks (5 Replies)
Discussion started by: namishtiwari
5 Replies

6. Shell Programming and Scripting

Need to Recover Deleted Files

Hi, By mistake, executed the following command : rm -rf * and ALL files got deleted. But I need to get back these files as they are very very important. Please help me how to recover this file. Its Urgent for me please. Thanks in advance. (6 Replies)
Discussion started by: unx100
6 Replies

7. Red Hat

Recover deleted files from linux server machine..

Hi, I am working Linux server machine. Somebody by mistake(or may be knowingly) deleted few folders and files from the machine. How is this possible to recover those files and folders????:confused: I normally logged in through Putty and winscp only. And don't have any history for putty... (8 Replies)
Discussion started by: pamu
8 Replies

8. UNIX for Advanced & Expert Users

How to recover the deleted file in Linux?

hi, i deleted one file from linux please let me know, if we can recover it ? if yes, pls let me know the steps to do.. (3 Replies)
Discussion started by: raghur77
3 Replies
UNLINK(2)						     Linux Programmer's Manual							 UNLINK(2)

NAME
unlink - delete a name and possibly the file it refers to SYNOPSIS
#include <unistd.h> int unlink(const char *pathname); DESCRIPTION
unlink() deletes a name from the file system. If that name was the last link to a file and no processes have the file open the file is deleted and the space it was using is made available for reuse. If the name was the last link to a file but any processes still have the file open the file will remain in existence until the last file descriptor referring to it is closed. If the name referred to a symbolic link the link is removed. If the name referred to a socket, fifo or device the name for it is removed but processes which have the object open may continue to use it. RETURN VALUE
On success, zero is returned. On error, -1 is returned, and errno is set appropriately. ERRORS
EACCES Write access to the directory containing pathname is not allowed for the process's effective UID, or one of the directories in path- name did not allow search permission. (See also path_resolution(7).) EBUSY The file pathname cannot be unlinked because it is being used by the system or another process; for example, it is a mount point or the NFS client software created it to represent an active but otherwise nameless inode ("NFS silly renamed"). EFAULT pathname points outside your accessible address space. EIO An I/O error occurred. EISDIR pathname refers to a directory. (This is the non-POSIX value returned by Linux since 2.1.132.) ELOOP Too many symbolic links were encountered in translating pathname. ENAMETOOLONG pathname was too long. ENOENT A component in pathname does not exist or is a dangling symbolic link, or pathname is empty. ENOMEM Insufficient kernel memory was available. ENOTDIR A component used as a directory in pathname is not, in fact, a directory. EPERM The system does not allow unlinking of directories, or unlinking of directories requires privileges that the calling process doesn't have. (This is the POSIX prescribed error return; as noted above, Linux returns EISDIR for this case.) EPERM (Linux only) The file system does not allow unlinking of files. EPERM or EACCES The directory containing pathname has the sticky bit (S_ISVTX) set and the process's effective UID is neither the UID of the file to be deleted nor that of the directory containing it, and the process is not privileged (Linux: does not have the CAP_FOWNER capabil- ity). EROFS pathname refers to a file on a read-only file system. CONFORMING TO
SVr4, 4.3BSD, POSIX.1-2001. BUGS
Infelicities in the protocol underlying NFS can cause the unexpected disappearance of files which are still being used. SEE ALSO
rm(1), chmod(2), link(2), mknod(2), open(2), rename(2), rmdir(2), unlinkat(2), mkfifo(3), remove(3), path_resolution(7), symlink(7) COLOPHON
This page is part of release 3.44 of the Linux man-pages project. A description of the project, and information about reporting bugs, can be found at http://www.kernel.org/doc/man-pages/. Linux 2011-09-15 UNLINK(2)
All times are GMT -4. The time now is 07:20 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy