[NTLUG:Discuss] need to recover deleted files

[Steve Baker]

Vaidya, Harshal (Cognizant) wrote:
> 
>   I am working on Solaris 5.8. I have accidently
> deleted 6 files.All of them were my code written from
> last 1 month. I need them back desperately. Please
> suggest me some ideas.

Whilst I'm no Solaris expert, there aren't usually undelete
commands on most UNIX systems.  Most 'undelete' mechanisms
entail not actually deleting the file in the first place - but
that's no use to you.

So - realising that I don't know for sure what you should do, and
that you only asked for ideas...

* Firstly, STOP USING THE MACHINE.

   Anything you do to it - including rebooting it - will have a
   likelyhood of overwriting that area of the disk permenantly.
   OTOH, if you just leave it there running, cron jobs could create
   files that overwrite your data.

* Immediately unmount that drive partition if you can.  *NOW* !!
   Don't waste a second!

* The only thing I think you have a chance with is to copy the entire
   raw drive partition (/dev/whatever) onto a file on another (larger)
   disk partition - or onto another computer entirely.  Once that information
   is there, it's safe and you can remount your drive partition and carry
   on working normally with the machine.

   If your data still exists, it's *somewhere* in that multi-Gigabyte
   file - in chunks of a few Kbytes of consecutive stuff interspersed
   with other junk...and not necessarily in the right order.

* Presuming there are strings in the file that you could recognise,
   you *might* stand a chance of writing a program to read out
   consecutive disk blocks that belonged to the files and paste them
   back together.  You'll almost certainly find a lot of partial
   copies of the files - some very old.  If these are large files, then
   patching them back together would be a significant effort with no
   guarantee of success.

* In all likelyhood, you are doomed no matter what.  But if you have
   lived a good life, the gods may smile on you and let you extract your
   files.

I'll spare you the usual diatribe about backing up your data...you
know that already.
---------------------------- Steve Baker -------------------------
HomeEmail: <sjbaker1 at airmail.net>    WorkEmail: <sjbaker at link.com>
HomePage : http://www.sjbaker.org
Projects : http://plib.sf.net    http://tuxaqfh.sf.net
            http://tuxkart.sf.net http://prettypoly.sf.net