No Undelete for Ext3

OK, this one will definitely make some Linux gurus laugh at me.

I have accidentally removed a directory with some music files I’ve downloaded off emule recently. My /home partition is ext3, so I tried to search for undelete solutions. I have recovered files from NTFS before, so I thought it was possible.

Bad luck, it seems. This page says it can’t be done. They make it impossible for security and reliability reasons, if I got it right.

It’s a pain to leech 79MB+ of data off emule again, especially with my nearly-dial-up 64k :( I guess I’ll know better next time. Backup!! And look closely before hitting Del!

How to shoot yourself in the foot?

% ls
foot.c foot.h foot.o toe.c toe.o
% rm * .o
rm: .o: No such file or directory
% ls

4 Responses to No Undelete for Ext3

  1. unixshell says:

    Stable, Door, Horse, Bolted.

    Sorry, untimely advice follows…

    1) “rm -i” will ask before actually deleting. Some Linux distros alias “rm” to “rm -i”, so in the example provided, “rm * .o” will expand to “rm -i * .o”, and ask:

    steve@elvis:~/sh/rm$ rm -i * .o
    rm: remove regular empty file `foot.c’? y
    rm: remove regular empty file `foot.h’? y
    rm: remove regular empty file `foot.o’? y
    rm: remove regular empty file `toe.c’? y
    rm: remove regular empty file `toe.o’? y
    rm: cannot lstat `.o’: No such file or directory

    (Yes, I provided the “y” responses).

    2) There’s also the option of creating your own “wastebasket” / “recycle bin” / call-it-what-you-will, by aliasing “rm” to a script which simply moves (mv) the file to (say) ${HOME}/.wastebasket/. You could even script it quite easily to say that /home/ascending/body/parts/foot/toe/toe.c would get moved to /home/ascending/.wastebasket/body/parts/foot/toe/toe.c, to avoid any potential confusion or frustration about one deleted file overwriting another.

    Erm, yeah. I’m a bit late with this …. Still, at least it wasn’t your dissertation due in tomorrow morning ;-)

  2. Constantin says:

    Thanks for the tips.
    1) The ‘foot’ example is provided as a little laugh (you can check the link above it), as it didn’t really happen like that. I had the wrong directory selected in Konqueror and I pressed Del. And I didn’t wait for the deletion to end and I pressed cancel. Maybe if I’d waited, the files would be in ~/.local/share/Trash where they usually end up when you delete stuff in KDE. But because I cancelled the deletion dialog, they weren’t there (and they disappeared from the original place too). A global find on / didn’t help, either. They were simply gone.
    BTW, about aliasing rm to ‘rm -i’: some people think it’s dangerous (I tend to agree):
    2) A great idea indeed. The only drawback I can see is that if you “rm” files from other partitions / disks / network mounts, it can take an awful amount of time for them to be moved to /home. And you can run out of space quick, too. Working around these would take a pretty advanced script.

  3. unixshell says:

    I agree completely about “rm -i”, I think it’s a stupid addition from a “professional” perspective; if files can’t be undeleted, then you need to learn that they can’t be undeleted, end of story. Being protected from it doesn’t really help. Putting a crash barrier by the side of the road helps safety but it doesn’t stop accidents.

    2) How about this? It would have to check that it could access the file (and its directory) before starting, and there are probably a few more ways of failing, but I think that Nautilus does something similar (~/.Trash)

    # Simple wastebasket, with paths.
    cd `dirname “$@”`
    # check for success
    cd –
    mkdir -p “${WASTE}”
    mv “$@” “${WASTE}”

    Still, it’s probably better to be aware of the risks, rather than to pretend that they don’t exist

  4. Iz says:

    il exite des outils comme the sleuth kit (TSK), ou photorec, mais le plus facile c’est encore ext3undelete:

%d bloggers like this: