On Fri, Mar 01, 2002 at 08:38:05PM +0100, Paul Seelig wrote: > On Thu, Feb 28, 2002 at 11:42:36PM -0600, Cheryl Homiak wrote: > > > I just deleted something I didn't want to delete; won't hurt my system, > > just destroyed some important records I was keeping. > > > *Immediately* unmount the partition holding this data! With > "*immediately*" i mean *IMMEDIATELY!*, or better put, RIGHT *NOW*! > > An now let's just calm down to be able to think for a minute.
A few days ago my fingers typed the command `apt-get clean'. What my brain intended was `apt-get autoclean'. Fortunately, I keep package files on a separate ext2 partition so unmounting it was quick and easy. I realise the deleted data are replaceable but 400M+ takes a long time to download on a modem link so I took the opportunity to have a look at how easy or hard it was to recover the files. If I failed to get them back it wouldn't be disastrous but it was annoying to have made a mistake with a command I was familiar with. > > Is there any way to undelete in ext3fs? > > > Since this is compatible with ext2, ext2 undeletion should be > possible. Now you have the possibility to find out yourself and tell > us whether this worked or not. The man page for Midnight Commander claims that undeletion is possible only with an ext2 file system. Your suggestion to explore whether it would deal with ext3 is reasonable but doesn't mc use debugfs which is designed for an ext2 file system? > There is a comfortable way for undeletion using the GNU Midnight > Commander, "/usr/bin/mc". If you have it installed, then start it up, > press "F9" and choose "Command | Undelete files (ext2fs only)". > > Enter the device file name without the leading "/dev/" of the > (hopefully unmounted!) partition containing the deleted files and > wait a few minutes until the panel contains a listing of deleted > files. Depending on size of the partition in question, this can take > up a considerable amount of time. So please be patient even if this > takes half an hour or even far more. I was aware that Midnight Commander has the facility you describe so I used it. It told me it was `loading deleted files information' and was still going strong after an hour. I went to bed, dreamt of inodes, got up and there it was still churning away. Now that partition only has about 50M of free space so I suspect there is insufficient room to write the undeleted files to it. A way to direct the file listing somewhere else would be useful. > The files in the resulting list don't carry names anymore and the > shown names are probably mere inode numbers(?) or similar. Check > which file(s) might contain the data in question and copy this file > into a directory located on *another* partition. Imagine a lot of .deb files. Imagine having to rename them correctly! The tedium involved, however, is very much offset by the pleasure of recovering them. > And if you've been able to save your data: Rejoice! Eventually I used the recover package from the testing distribution. You can select deleted files by date and time of deletion and dump them to a directory on another partition. It was also quite quick. Having read about the difficulty of undeleting files on unix systems I found the performance of this program impressive. [Snip good advice on backups] Brian.