Re: recover deleted file

> Depends on the kind of file.
> 
> You can always:
> 1. reboot the system into single user mode, mount the fs readonly (important=
>  to not overwrite data you want to recover)
> 2. dd the partition and into a file
> 3. find the content of the deleted file in the dump
> 
> I was able to recover a complete codebase i deleted accidentally that way a l=
> ong time ago.
> 
> Good luck
> Michael

If it was my personal laptop with an external disk/ stick,
I would _immediately_ pull the USB cable out.
If a personal PC I would _immediately_ turn power off.
I would Not do an unmount or sync or processes kill or shutdown.

Then I would reboot single user, 
fsck & mount only the partitions the data was Not on.,
dd the partition to recover,
then fsck the partition & mount it, & go multi user,
then I'd make a 2nd copy of the partition with data to recover
& start exploration with eg fsdb
man fsdb:
SEE ALSO
   editline(3), fs(5), clri(8), fsck(8), /usr/ports/ { graphics/recoverjpeg,
     sysutils/ { autopsy, dd_rescue, ddrescue, fatback, ffs2recov, foremost,
     gpart, magicrescue, recoverdm, scan_ffs, sleuthkit, testdisk } }.

If you work had been on text using vi, then vi -r might show a recovery,
hint copy the original before running vi -r file , as sometimes pre recovery
is better than after.

various lost+found may have stuff in
http://berklix.com/~jhs/bin/.sh/lslf

PS personaly I hand run numerous rdist6 or rsync through the day,
when editing important stuff. They run fast, as incremental update,
so avoid losing all but the last short period in a day.

Cheers,
-- 
Julian Stacey  http://berklix.com/jhs/ http://StolenVotes.UK  
Kill / remove Putin to stop him killing & provoking world war.