Linux does the same thing as DOS (unless you use something like shred to
delete your files...), but on a busy system, especially if the drive is
fairly full, those blocks can get written over pretty quickly. Also,
finding the deleted files and linking inodes back to blocks can be time
consuming and difficult, but it is possible to undelete files (best I've
ever done is recovered a few files <4kB as 4k is the block size on
ext2). If you're not on ext2 I'd say goodbye to your files unless your
fs has a debug program.
CD-R[W], tape, zip drive, even floppies...BACK UP YOUR FILES. Even if
you have a 10 level RAID 1 array, your hardware may not fail, but the
user will eventually. I know, I typed rm -rf * in my home dir a couple
months ago (thought I was a couple dirs deeper). Stopped it as soon as
I noticed it wasn't instant, but I did lose a few files I cared about.
Fortunately, I just walked over to my other box, popped the correct tape
in, and ripped the files right back out of the tar archive. The mistake
cost me time, but not data.
--MonMotha
Eric Hattemer wrote:
Tape backups. That's about your only choice. You could use your window
manager's trash can instead, but no, once files are deleted, they're gone
for good unless you backed them up. Instead, next time use "rm -ir blah"
and it'll ask you "do you want to delte blah 1? blah 2?" and if it seems
like its definitely deleting the correct files, they ctrl-C and rm -rf.
I've never heard of an undelete program for linux. I don't think one
exists. Even the ones for windows rarely worked properly. I know in DOS,
if you delete a file, it just marks those clusters as capable of being
rewritten, then hides them. I don't know what linux does.
-Eric Hattemer
