Hi,
In tcsh, I mistakenly deleted some files under a dir with rm *
Is there any way by which I can recover those files (without restoring to an earlier backup point) ?
I mean any command like undelete or anything similar
If you have any programs running that still have the files open or if you have any other hardlinks to the files, they can be recovered.
If the data is of sufficient value to warrant it, you can ship the disk to a data recovery specialist but these people generally charge a great deal for this sort of work.
Otherwise I'm afraid you are looking at a restore from backup as your only other option.
Manier times the editor you use (I use vi & emacs) creates it own temporay backup files. If you can not recover the original one, you can use the backup files. They normally contains the data till your last save
It would depend heavily on the name of the backup file though. Emacs just adds a tilde (~) character to the name, so that would have been also deleted by an rm *. Generic vi doesn't save backups but there's a stack of varients out there, if it happens to save to a .blah file, those would have been preserved.
If the process is still running and did not yet close the file descriptor you can recover it directly via the file descriptor in /proc (on linux)
I think the short answer is " game over, unless you are into heavy wizardry".
How to do this ? ( out of curiosity )
Did you mean the following steps ?
1) dup the file descriptor ( that is known )
2) use the new file descriptor to iterate through the contents of the file and store it again
Could you please shed more light on this ?
In the case of OS'es with /proc available, you can use lsof to get the file handle number of the file in question (lsof -p pid /dev/dsk/disk-in-question) then copy the contents of /proc/<pid>/fd/<handle number>.
Hello everyone.
So .. yeah.. I was cleaning up and. darn the luck . I scrubbed a bit too hard. 
Nothing critically important lost. Just some old pics that would be nice to have and thought I had copied them. I am trying out the CGSecurity utility recomended by rajamohan.
I will keep you posted how it works. There was next to no disk activity after the delete. realized I did something dumb in about 3 seconds. unmounted the fs and giving the utility a try.
Yeah it worked like a champ. Turns out I panicked and actually DID copy the files i thought I lost. I guess burning the candle on 2 ends 4 sides and behind will cloud one's judgment.
Anyways. the GC sec tool worked well. It pulled stuff off the disk I had long forgotten about.