restoring files deleted with 'rm'

[joshuajestelle]

hi everyone,

so i just accidentially deleted some files using 'rm' in the terminal.

is there a way to restore these files?

i'm running 10.3, panther.

thanks,
josh

[jdhorner]

in short, no.

perhaps there is some sort of unix/HFS+ util that is able... i am not aware of any.

perhaps it's best if from now on you used "rm -i" to get confirmation on deletion.

[joshuajestelle]

Quote: Originally posted by jdhorner perhaps it's best if from now on you used "rm -i" to get confirmation on deletion.

I actually do us 'rm -i' (alias that way), but unfortunately I am too quick to type 'y'.

I was writing some Java code and I wanted to clean up my directory so I was going to delete the .class files.

So I quickly typed: rm *.java, and pressed y, enter, y, enter, y, enter... a few times until I realized what I was doing.

I managed to delete several of my source code files, a couple of which were very small and very easy to rewrite, but at least one of which was very long and fairly complicated.

I still haven't been able to find a suitable undelete method, but I did find a java decompiler that works, JAD. Since I still had the .class files I could decompile the source code out of them, and other than my variable names and commenting being stripped from my code, its at least functionally equivalent.

But anyway, it seems with HFS+ being a Journaling filesystem there should be some fairly easy tools for undeleting things right after you delete them?

Oh well. If anyone comes across any, please post, as something like that could always be useful in the future when I "rm -rf /" by accident. ;-)

Thanks,
Josh

[Leo_de_Wit]

The best means to avoid loosing things:
backup, backup, backup!

If you need to undelete (by means of recovering disk blocks that have been added to the list of free blocks):
be quick (that is: don't wait too long)!

Do as least as possible on the filesystem, since all write actions may involve the old data.
This includes installing recovery software (better install it on a separate partition, or run it from a CD).

My € 0,02 (two euro-cents)

Leo

[pink]

There's a package called TCT , which contains the unrm and lazarus tools.I didn't use them, so I can't tell if they work on OS X. A short how-to is found here . Note that it is essential that you stop writing onto the disk immediately...
Still better would be to get into the habit of using something like

alias del 'mv \!* ~/.Trash'

or

alias del '/Developer/Tools/MvMac \!* ~/.Trash'

cheers, pink

[hayne]

Quote: Originally posted by joshuajestelle it seems with HFS+ being a Journaling filesystem there should be some fairly easy tools for undeleting things right after you delete them?

No - journaling doesn't do what you think it does. Journalling merely ensures that disk writes are atomic - so that if e.g. the power is interrupted in the middle of a write, the system is able to recover and undo the partial write. It does not provide any permanent records that could be used in un-deleting.

[Leo_de_Wit]

Quote: Originally posted by pink Note that it is essential that you stop writing onto the disk immediately... Still better would be to get into the habit of using something like alias del 'mv \!* ~/.Trash' or alias del '/Developer/Tools/MvMac \!* ~/.Trash' cheers, pink

Hi pink!
In fact you're moving the 'to be deleted files and dirs' to the thrashcan yourself (via the shell).
Does the Finder have any knowledge about where the deleted file etc. are coming from?
I guess it does, since it undeletes the file to its previous location.
This seems to favor the MvMac tool, which is resource-aware (as opposed to mv).

Volunteer wanted to undelete a file removed by either of these
(I'm Mac-less at the moment, or - owning a powerbook -: powerless! )

I like the lazarus name, btw (resurrecting from the dead, read the Bible for details).

Leo

[pink]

Quote: In fact you're moving the 'to be deleted files and dirs' to the thrashcan yourself (via the shell).

Yep, that's the intention. I prefer to have my deleted files available in my thrashcan for recycling (you never know, as we have seen ). This does not help to restore files to their previous location, but at least they are still there.

There are some drawbacks to this solution:
- You should remember to empty the Trash from time to time
- If you "del" two files with the same name, the first one is gone for good...
- the first version makes you lose resource forks

still, I found this a better way to "remove" files.

cheers, pink

[Leo_de_Wit]

Quote: Originally posted by pink Yep, that's the intention. I prefer to have my deleted files available in my thrashcan for recycling (you never know, as we have seen ). This does not help to restore files to their previous location, but at least they are still there. There are some drawbacks to this solution: - You should remember to empty the Trash from time to time - If you "del" two files with the same name, the first one is gone for good... - the first version makes you lose resource forks still, I found this a better way to "remove" files. cheers, pink

You can also store the complete path, by the equivalent of:

Quote: Let's say you must del /usr/local/bin/some_file. Do this by a Quote: mkdir -p ${HOME}/.thrash/usr/local/bin and then Quote: mv /usr/local/bin/some_file ${HOME}/.thrash/usr/local/bin

To overwrite a file this way,
it had to be on the original spot in the filesystem anyway,
so this isn't an issue.

Note I would prefer to have a ${HOME}/.junkyard instead of ${HOME}/.thrash,
since this avoids clashes with the standard thrashcan.

Homework: write the del and undel commands as shell scripts.
(not too hard: undel can do a find from the thrashcan location).

Leo

[acme.mail.order]

I have heard (but never needed to try - knock knock) that it is possible to run grep on the /dev/hd~~ virtual directory and scan for the text you need. Sounds theoreticaly possible, but as it would be scanning the drive block by block be prepared for a loooooooong search and tons of junk output. I would also think that if you've used the drive for more than 10 minutes after the 'oops' that it's not worth the effort - save this for when you really need something, but don't want to drop $1000 on data recovery.

Now, do the following:

for ($i=1; $i < 1000; $i++) 
{
  speak "I will make backups";
  if (!$i % 10) 
     flog(self, "10baseT cable");
  else flog(self, "wet noodle");
}

[joshuajestelle]

Quote: Originally posted by pink alias del '/Developer/Tools/MvMac \!* ~/.Trash'

I tried this but it didn't work for me. Perhaps because I'm using a bash shell?


I did:

alias del='/Developer/Tools/MvMac \!* ~/.Trash'
touch ding
del ding

and i got the following:
destination is a file but more than one source is specified (0)

Any ideas?

Thanks,
Josh

[fxt]

see these two threads for scripts that rm files to the trash:

http://www.macosxhints.com/article.p...21018054958105

http://www.macosxhints.com/article.p...30217172653485

fxt

[pink]

Quote: alias del='/Developer/Tools/MvMac \!* ~/.Trash'

that should probably be

alias del='/Developer/Tools/MvMac $* ~/.Trash'

example:

bash-2.05a$ alias foo='echo \!*'
bash-2.05a$ foo bar
!* bar
bash-2.05a$ unalias foo
bash-2.05a$ alias foo='echo $*'
bash-2.05a$ foo bar
bar

But even then there's strange things going on:

alias del='/bin/mv $* /Users/pink/.Trash/'
bash-2.05a$ touch ding
bash-2.05a$ del ding
/bin/mv: rename /Users/pink/.Trash/ to ding: Not a directory
bash-2.05a$ unalias del
bash-2.05a$ alias del='/bin/mv /Users/pink/.Trash/ $*'
bash-2.05a$ del ding
/bin/mv: rename /Users/pink/.Trash/ to ding: Not a directory

I'm not using bash, so I'm at a loss what that could be. I only found an old reference for a similar behaviour here

cheers, pink

[hayne]

Quote: Originally posted by pink alias del='/bin/mv $* /Users/pink/.Trash/'

From the bash reference manual (http://www.faqs.org/docs/bashman/bashref_70.html):

Quote: There is no mechanism for using arguments in the replacement text, as in csh. If arguments are needed, a shell function should be used (see section 3.3 Shell Functions).

[Leo_de_Wit]

Quote: Originally posted by hayne From the bash reference manual (http://www.faqs.org/docs/bashman/bashref_70.html): Quote: There is no mechanism for using arguments in the replacement text, as in csh. If arguments are needed, a shell function should be used (see section 3.3 Shell Functions).

Such a function could be:

Quote: function del() { mv $* ~/.Trash/; }

or

Quote: function del() { mv -f $* ~/.Trash/; }

if you wanted to make sure.

Since we already using functions,
I would prefer to move it to a yet unused filename within ~/.Trash,
and store the file's original location together with its new name, in an admin file.
(This avoids clashes with already used names).
For a lazarus function, it's then easy to restore the file to its original location.

Leo