04-10-2015 03:20 AM
Hello.
I've a vxfs filesystem (vxfs 5.0).
Yesterday I've accidentally deleted a directory containing about 1000 files.
Today I've remounted the filesystem readonly; I want to try to recover that deleted files (if they are not already overridden).
Exists some tool to do that?
Thankyou
Matteo
04-10-2015 04:28 AM
There is no 'undelete' function or command in Unix or VxFS.
The only way to get the deleted files back is to restore from backup.
04-10-2015 04:38 AM
Yes, an 'undelete' command does not exists, and the filesystem does not save 'undo' informations.
I'm searching a tool that analize filesystem in raw mode and try to find the deleted files.
04-10-2015 05:40 AM
And when you have stopped looking for something that probably does not exist... I hope that you have a backup solution in place that automatically takes scheduled backups?
04-10-2015 05:51 AM
I agree with Marianne as tools that analize filesystem in raw mode look for particular file formats like pictures and video where there are well defined boundaries and patterns to look for the files, so if you are trying to recover generic files of different types, then such a tool will not work. To protect against future deletions, then you can use storage checkpoints as well as regular backups of course.
Mike
04-10-2015 06:01 AM
Thankyou.
Files are text-only; I know the filename and the structure of every file.
Filesystem is too large to do a regular backup.
The 'checkpoints' may be an idea for the future.
04-10-2015 11:36 AM
There is simply no way to recover deleted files in Unix other than from a backup.
Something we learn on day 2 of a basic Unix training course....
Symantec NetBackup has excellent solutions for large filesystems.
Please speak to your reseller.
04-10-2015 02:33 PM
If you know format of file then you could write your own program - something like:
strings /dev/vx/dsk/testdg/testvol | awk ' /start_pattern/ {n+=1;filename="/recover/file"n;want=1} want ==1 {print $0 > filename } /end_pattern/ {want=0}'
Maybe able to get filename also with a bit more intelligence.
But make sure you recover files to a different filesystem and note if files are fragmented then this won't work well and you will probably also get incomplete files from parts of files that have been overwritten.
Mike