[vox-tech] File recovery?

[ME]

On Mon, 2 Sep 2002, ME wrote:
> This is rather impressive. I just did a search and came up with this. Have
> you ever used midnight commander? I never knew this was available!
> 
> mc cd /#undel:hda3
> 
> I tested this on a filesystem (/tmp). After creating a file, running sync,
> and then deleteing the file, I ran mc with the above arg and the partition
> for /tmp. I was able to find the filename and copy the file to another
> filesystem on another partition. The file was very short, but it worked!
> 
> I think this is something for the LUGOD FAQ!

(Being rude and replying to myself)

If you go to attempt this, and have never used mc before, the left pane
has the list of "files" to try to undelete. Since the name is a number for
ref, I found it easier to sort this pane by modification date.
F9, "sort order...", Modify time. 

Of course, if you know the size of the file you want to undelete, then
size may be right for you.

After you find the file you want to undelete, you can "copy: (F5) the file
to another filesystem (or try to).

There is another option that I have not tried...
F9, (right arrow), (right arrow), (command menu, choose "undelete files")
which allows you to specify what partition/dev you want to use for
undelete.

Last note, of course I was root but could have put myself in the "disk"
group on my debian system instead.

This is just sooo cool!

-ME

-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GCS/CM$/IT$/LS$/S/O$ !d--(++) !s !a+++(-----) C++$(++++) U++++$(+$) P+$>+++ 
L+++$(++) E W+++$(+) N+ o K w+$>++>+++ O-@ M+$ V-$>- !PS !PE Y+ PGP++
t@-(++) 5+@ X@ R- tv- b++ DI+++ D+ G--@ e+>++>++++ h(++)>+ r*>? z?
------END GEEK CODE BLOCK------
decode: http://www.ebb.org/ungeek/ about: http://www.geekcode.com/geek.html