On Fri, 29 Jul 2016, GUGLHUPF wrote:
fairly new to git. Today I did a "git add somefile" and then decided I
wanted to unstage it. I did then a "git rm -f somefile". There was no git
command in between. Particularly no commit.
git wiped the file from disk. I worked very hard on that file (several days(
and I really hope this can be recovered. I could not find a solution on the
For completeness I did a git reset HEAD somefile because that's what I found
on the web, but it didn't recover the file.
Is there a way to recver somefile?
I hope the advice that was given to you would work.
In general if you want to be absolutely sure that a file is recoverable.
You unplug the power cord ASAP.
Then you boot your handy secondary system that you have on USB.
I don't know if you are a Windows or Linux user here. I will assume Linux.
When you have booted your USB stick or Live DVD, you install the package
You run "lsblk" to find the partition and device your file resides on.
If you have a dedicated home directory, take not that the relative path to
your home directory on that partition will then not be /home/user, but
If it is on the root filesystem, it will be /home/user.
extundelete is not all that user friendly but with a little knowhow it
You go first to a temporary directory, such as /tmp. In a Live DVD /tmp
will usually be on a RAM disk. Sometimes you need a lot of space, but in
this case you can manage it with just RAM.
so "cd /tmp"
Then if you know the full path to your working directory by heart, it is
You would do:
extundelete /dev/sdaX --restory-directory home/<user>/<work-directory>
sdaX must be the device and partition your file was on.
This is what you learned from lsblk.
The rest speaks for itself. If your home directory was encrypted (using
e.g. eCryptFS) it gets much more troublesome.
If your home directory was not encrypted using eCryptFS, but the entire
harddisk was encrypted using LUKS, then it is much more possible and
In that case you must first open the encrypted drive using cryptsetup
open, but that goes beyond what I can say here.
Say yes to all the questions extundelete gives you. If you misspell a
directory name, it will give you a list of options, then you have to try
again. Once you have given a correct directory name, extundelete is going
to undelete ALL files in the specified directory. The output will be place
in a directory in the location you were at (your temp directory) called
There are other options, such as photorec (or testdisk). Photorec is also
easily installable under Linux, including any Live DVD session.
photorec is a tool that will just recover everything it can find,
including fragments of files, you can set it to find e.g. all text files,
and it will recover a "shit load" if you are not careful. For photorec on
a normal system you may need several gigabyte to store everything it
So you could use any 32GB usb stick for that. Or just attempt to use /tmp.
photorec will store everything but not with the filenames. Again, full
disk encryption is not a problem here, but home directory encryption would
be a big problem for photorec.
In order to then find you file, or see if it is there, you would use "grep
-r "text to find"" on a modern Linux system. This would just search all
the recovered files for the text you need.
If it was a text file, of course. Anything else (such as odt) would be
more troublesome. So these are your options for real deleted file
recovery. I would hope that the suggestions you have been given work out
for you, it would save a lot of time.
And, if you keep your system running, chances are very high that
extundelete won't be able to recover your file anymore.
Photorec might have a better chance, but even that might not work. I do
not know how eagerly ext filesystems overwrite previously used space.
If you are on Windows, naturally photorec will also recover files from
your NTFS partition. And the same would apply to the Mac I guess.
So personally if this happened to me.... I would first create a backup of
the working directory but to a different drive/partition. Then I would
think about unplugging the power cord. If you know for a fact that the Git
mechanic is going to work, be your own guest you know. But if it is really
important, safety first, I guess.
Doing any kind of operation on your computer is probably quickly going to
overwrite that space.
ps. I feel that the good advice that actually works (not trying to offend
anyone here) is often disregarded. Undeleting files IS a possibility. If
you act immediately, it is a guarantee. It is annoying to do and takes a
lot of time, but it works. Even remounting your filesystem read only would
be a better thing to do, if it works. "sudo mount -o remount,ro /" would
do that trick.
Then if your system doesn't come crashing down ;-) you can copy the
working directory to another location.
I just feel users are uneducated on this subject. Miseducated perhaps.
Anyway, I hope you will be able to execute the commands given and recover
your file from the Git store regardless.