Re: How to undelete a file?

[Walt H <waltabbyh@mindspring.com>]

Unfortunately, from what I recall, there's not an easy way to recover 
deleted files short of having a good, recent backup around. Check out:

http://marc.theaimsgroup.com/?l=linux-xfs&w=2&r=1&s=undelete&q=b

for more info on the subject.

-Walt

Friedrisch Muller wrote:
> Hi,
> 
> I've accidentially deleted a file on my XFS 1.0.2
> filesystem under RedHat Linux 7.2 2.4.9-21 i686.
> 
> I know the exact name of the file and the exact place
> of the file in the directory tree. After the
> accidential "rm myfile.txt" I directly unmounted the
> filesystem.
> 
> Is there a way to get it back? 
> 
> For example under Linux ext2fs it is quite easy (this
> is documented in a mini-howto from linuxdoc):
> 
> 1. Unmount the filesystem.
> 2. Start "debugfs".
> 3. Walk to the directory.
> 4. Dump the directory content data
>    (debugfs: dump <inode of directory> /tmp/dirdata).
> 5. Exit debugfs.
> 6. Load the data into a hexeditor.
> 7. Check the inode of my deleted file (it is still
> there in the directory data, only the "pointer" to the
> next entry in the directory has increased so it now
> points after my deleted file's directory entry).
> 8. Start debugfs again.
> 9. Add the file to a directory under a certain name
> with the old inode number (debugfs: modify_inode
> <inode of my deleted file>)
> 10. Set deletion time to 0 and link count to 1.
> 11. Dump my deleted file
>     (debugfs: dump <inode of my deleted file>         
>    
>                    /tmp/mydeletedfile)
> 
> Please, help...
> 
>      Regards / Friedrisch
> 
> __________________________________________________
> Do You Yahoo!?
> Send FREE Valentine eCards with Yahoo! Greetings!
> http://greetings.yahoo.com
> 
>