Recover deleted file

There is no 'undelete' function or command in Unix or VxFS.

The only way to get the deleted files back is to restore from backup.

Yes, an 'undelete' command does not exists, and the filesystem does not save 'undo' informations.

I'm searching a tool that analize filesystem in raw mode and try to find the deleted files.

And when you have stopped looking for something that probably does not exist... I hope that you have a backup solution in place that automatically takes scheduled backups? 

I agree with Marianne as tools that analize filesystem in raw mode look for particular file formats like pictures and video where there are well defined boundaries and patterns to look for the files, so if you are trying to recover generic files of different types, then such a tool will not work.  To protect against future deletions, then you can use storage checkpoints as well as regular backups of course.

Mike

Thankyou.

Files are text-only; I know the filename and the structure of every file.

Filesystem is too large to do a regular backup.

The 'checkpoints' may be an idea for the future.
 

There is simply no way to recover deleted files in Unix other than from a backup.
Something we learn on day 2 of a basic Unix training course....

Symantec NetBackup has excellent solutions for large filesystems. 

Please speak to your reseller.

If you know format of file then you could write your own program - something like:

strings /dev/vx/dsk/testdg/testvol | awk '
  /start_pattern/ {n+=1;filename="/recover/file"n;want=1}
  want ==1 {print $0 > filename }
  /end_pattern/ {want=0}'

Maybe able to get filename also with a bit more intelligence.

But make sure you recover files to a different filesystem and note if files are fragmented then this won't work well and you will probably also get incomplete files from parts of files that have been overwritten.

Mike