We have a situation in a large dept of programmers where critical accounting data files were deleted. Is there any way in UNIX to trace deletions and or possibly retrieve the deleted file?
Simple: just mount your backup tape and restore the needed file. You do backup your critical files, right?
In general, there is no "undelete" function in Unix. You can also ship the drive off to one of the "data recovery" companies -- but they will charge you an exhorbitant fee and cannot guarantee data retrieval.
Location: Asia Pacific, Cyberspace, in the Dark Dystopia
Posts: 19,118
Thanks Given: 2,351
Thanked 3,359 Times in 1,878 Posts
Some people alias the rm command so that it makes copies of the files to a specified directory and then deletes.... this is common practice by system admins when users tend to delete files with rm. If you alias or replace with a script to create backup copies, life can be easier if you have users who tend to make mistakes.
BTW: I don't do the above ...!!.... I tend to create backup copies manually when editing files or performing trickly delete operations. For example, if working on a file... I first create a file.original backup.... same with directories...... then when the work is complete and tested I delete the original-working files.
Thanks for your input. We also have similar practices set in place, but the renaming does not always take place. I will look into the rm command option. That sounds like something that could prove to be a lifesaver for those who do not carefully execute this command.
I appreciate you input.
Location: Asia Pacific, Cyberspace, in the Dark Dystopia
Posts: 19,118
Thanks Given: 2,351
Thanked 3,359 Times in 1,878 Posts
Thanks for the link to the 'recover-lost-files' page..... the paper (quoted below) mentioned a few utlities like unrm and lazarus. Any idea where to get these tools? I could not find the reference to these tools or a link on the page.
I want to try this .... !!!
Quote:
Cliff Notes Version: Use "unrm" to recover the data, from the file system with the lost file, to another file system; run lazarus, and comb through the results until you find your data.
Maybe the tools mentioned are in the TCT distro? Link below:
Just looking for some guidance on how to figure out who might have deleted some files off one of my systems.
These files are not root owned files so could be deleted by a handful of folks in the group responsible for these files besides the root users.
Anyway I have been tasked with trying to... (1 Reply)
Hello. I am having a problem and I was wondering if I could get some help from here. I changed into a directory with the cd command and I wanted to delete a folder and all of its subdirectories, so I went ahead and did a rm --recursive * in my current directory to realize that I was in the wrong... (3 Replies)
Is there a relatively simple step by step to find what has been deleted? Am aware of how to do it in Windows. Forgive my ignorance am new to Linux.. (1 Reply)
Hi,
By mistake, executed the following command :
rm -rf *
and ALL files got deleted.
But I need to get back these files as they are very very important.
Please help me how to recover this file. Its Urgent for me please.
Thanks in advance. (6 Replies)
Hi All,
I am using Fedora Core and Windows Xp. I deleted all the files from root
directory. When i am trying to restart the computer it showing some grub > prompt. What i will do ? I have lots of data in XP OS.
Please help me
i used
# rm * (8 Replies)
I had a user run, by accident, the following line command on our UNIX server:
rm -f /usr/*
This apparently deleted some needed files on your system. Having very limited knowledge in UNIX, I thought I would ask the group if anyone knows how I can recover these file?
The version of UNIX is... (3 Replies)
01-23-2002
Retrieval of deleted files
