up vote 3 down vote favorite
2
share [g+] share [fb]

Possible Duplicate:
undo Linux's rm?

is it possible to undo a rm somefile command in linux?

and if so, how does one do that?

link|improve this question
The classic beginner's trap. – thosewhatnots Nov 16 '10 at 14:00
What is you OS? FS? – osgx Nov 16 '10 at 14:10
feedback

migrated from stackoverflow.com Nov 16 '10 at 14:03

This question came from our site for professional and enthusiast programmers.

closed as exact duplicate by Sathya♦, grawity, Diago Nov 17 '10 at 7:01

This question covers exactly the same ground as earlier questions on this topic; its answers may be merged with another identical question. See the FAQ for guidance on how to improve it.

5 Answers

up vote 10 down vote

rm doesn't move the file to some trash directory, it deletes it. Thus you cannot, in normal ways.

You could try with some tool to find removed files on the filesystem. If you want to try I suggest you to immediately unmount your filesystem and not mount it (in readwrite) until you found back your files or until you give up.

If you're scared of removing files, you should replace your rm command with another one that asks confirmation before permanently remove files. You can use an alias to this purpose:

alias rm="rm -i"
link|improve this answer
Or replace it with a command that moves them to a .trash folder instead of deleting them. – gkrogers Nov 16 '10 at 16:46
feedback
up vote 3 down vote

Here is a good article

http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html

The most frequently quoted passage comes from the ext3 FAQ itself:

Q: How can I recover (undelete) deleted files from my ext3 partition?

Actually, you can't! This is what one of the developers, Andreas Dilger, said about it:

In order to ensure that ext3 can safely resume an unlink after a crash, it actually zeros out the block pointers in the inode, whereas ext2 just marks these blocks as unused in the block bitmaps and marks the inode as "deleted" and leaves the block pointers alone.

Your only hope is to "grep" for parts of your files that have been deleted and hope for the best.

link|improve this answer
That would be interesting to grep the filesystem device for parts of the file. Might actually work, at least in part. – David Nov 16 '10 at 14:05
@David, the article linked is about ext3grep – osgx Nov 16 '10 at 14:10
feedback
up vote 2 down vote

Not normally, no - it's been deleted, and there isn't normally an undelete comand. It's for that reason that the very first thing that my first Software Engineering professor told the class to do was to redefine the rm command to mv (move) the file(s) to a .trash folder.

link|improve this answer
feedback
up vote 1 down vote

You might want to try creating a recycle bin. Here's instructions using SAMBA in a Ubuntu server: http://ubuntuforums.org/showpost.php?p=1252880&postcount=7

link|improve this answer
feedback
up vote 0 down vote

It might be possible, but more details are needed, at first limit you operations on that filesystem.

Please give your operating system name, kernel (uname -a), mount points (mount) and path of the file.

link|improve this answer
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.