Undo delete

UNIX for Advanced & Expert Users
1

HI folks,

I have just deleted a folder which i need it back. I am not a big
unix user so any help is appreciated. The thing is that i had found
images in a folder:

./home/tom/.kde/share/cache/http/b/[filename_removed].jpg
as you can see these images should not really be here.
When i asked a guy in work to get details on them he deleted them

instead, crossed wires!!!! he typed ( rm -rf tom )
The thing is, the images are on a managed sever not in our premises
and the /tom folder is the name of the guy who manages it. And there
were a lot worse www's in the folder which is why i am looking for
help.

If anybody can help me to retrieve the folder it would be much
appreciated

Regards

Cormac O'Donnell

EDIT: I removed the filename as it was offensive and serves no purpose - Zazzybob

2

Under UNIX, if files are removed there is generally no way of undeleting them - your only choice is to restore from a backup.

Under some circumstances if the disk can be brought immediately offline after the deletion and mounted read-only, a data-recovery company/expert may be able to recover some of the data - however seeing as this is a managed server which is probably using some kind of RAID, the areas of the disk(s) that held this information before will no doubt have been written to.

Cheers
ZB

3

You might try "unrm". A friend used it years ago and said it works.

Or do a search on google for more hits.

4

I think "unrm" only works on ext2 filesystems.... i know ext3 can be mounted ext2 but you cannot undelete from a jounalled ext3 filesystem - to quote from a post on the Linux kernel mailing list

I suppose it's all academic until we find out what filesystem the OP is using....

Cormac: please post the output of df -hT (I assume you're running Linux here....)

Cheers
ZB

5

Output:

Filesystem Type Size Used Avail Use% Mounted on
/dev/sda6 ext3 372M 116M 237M 33% /
/dev/sda1 ext3 45M 14M 29M 32% /boot
/dev/sda5 ext3 13G 9.4G 2.8G 77% /home
none tmpfs 251M 0 250M 0% /dev/shm
/dev/sda2 ext3 35G 7.4G 26G 22% /usr
/dev/sda7 ext3 251M 30M 208M 13% /var

take it i'm jiggered on that front since its ext3.....But....

I could be in luck as i have found a tar file named home_accounts_20040901.tar, take it at face value and say that its a backup of the home accounts ;). Only thing is its 3GB,gonna take 18hrs to download. was looking around on a lot of sites yeasterday to see how i could look inside the archive, i have been able to list the files in it but it just lists thousands of files. The folder i am looking for was called "tom" and was a subfolder of "home" any way of searching fof this in the archive??

Thanks for the replys

Cormac

6

Let's say the backup is located at /backup/home_archive.tar

If you do

cd /backup
tar xvf home_archive.tar "home/tom/*"

You'll recursively restore home/tom to /backup, so the restored home directory is located at /backup/home/tom

Cheers
ZB

7

cheers buddy

8

i face same situation as like you, I feel so tension now. Have anybody know how to retrieve the file back?