cancel
Showing results for 
Search instead for 
Did you mean: 

Recover deleted file

mrossini
Level 3

Hello.

 

I've a vxfs filesystem (vxfs 5.0).

Yesterday I've accidentally deleted a directory containing about 1000 files.

Today I've remounted the filesystem readonly; I want to try to recover that deleted files (if they are not already overridden).

 

Exists some tool to do that?

 

Thankyou

Matteo

7 REPLIES 7

Marianne
Moderator
Moderator
Partner    VIP    Accredited Certified

There is no 'undelete' function or command in Unix or VxFS.

The only way to get the deleted files back is to restore from backup.

mrossini
Level 3

Yes, an 'undelete' command does not exists, and the filesystem does not save 'undo' informations.

I'm searching a tool that analize filesystem in raw mode and try to find the deleted files.

 

Marianne
Moderator
Moderator
Partner    VIP    Accredited Certified

And when you have stopped looking for something that probably does not exist... I hope that you have a backup solution in place that automatically takes scheduled backups? 

mikebounds
Level 6
Partner Accredited

I agree with Marianne as tools that analize filesystem in raw mode look for particular file formats like pictures and video where there are well defined boundaries and patterns to look for the files, so if you are trying to recover generic files of different types, then such a tool will not work.  To protect against future deletions, then you can use storage checkpoints as well as regular backups of course.

Mike

mrossini
Level 3

Thankyou.

Files are text-only; I know the filename and the structure of every file.

 

Filesystem is too large to do a regular backup.

The 'checkpoints' may be an idea for the future.
 

Marianne
Moderator
Moderator
Partner    VIP    Accredited Certified

There is simply no way to recover deleted files in Unix other than from a backup.
Something we learn on day 2 of a basic Unix training course....

Symantec NetBackup has excellent solutions for large filesystems. 

Please speak to your reseller.

 

mikebounds
Level 6
Partner Accredited

If you know format of file then you could write your own program - something like:

strings /dev/vx/dsk/testdg/testvol | awk '
  /start_pattern/ {n+=1;filename="/recover/file"n;want=1}
  want ==1 {print $0 > filename }
  /end_pattern/ {want=0}'

 

Maybe able to get filename also with a bit more intelligence.

But make sure you recover files to a different filesystem and note if files are fragmented then this won't work well and you will probably also get incomplete files from parts of files that have been overwritten.

Mike