Re: tlug: Discovery! Undeleting files with MC

[Peter Linsley <plinsley@example.com>]

Hi,

A trick I picked up once was a nifty way of getting back plain text files
you just deleted. Like similar hacks, it is in no way guaranteed.

Just search for ascii strings in the device the file once resided.
If I just deleted an important email from the first partition of
my SCSI drive, this should pull the mail text back out:

strings /dev/sda1

Well, I found it useful once or twice....

Regards,

pete

Your message dated: Mon, 11 Jan 1999 15:25:56 +0900
> Hi, folks--
> 
> Since questions about recovering deleted files have come up from time
> to time, I thought I'd share something I found out last night:
> 
> If you use Midnight Commander (if you don't, why on earth not?), you
> probably know that it supports several types of 'virtual filesystem'
> ... e.g., you can browse through directories inside an RPM or tar
> archive. You may not have known that it also has an 'undelete file
> system' ... you can use the menu, or you can enter a command like 'cd
> undel:/dev/hda7', and voila!
> 
> The help file says something about needing to have the kernel
> configured with such-and-such an option in order to be able to use
> this ... but I don't *think* I selected whatever that was when I
> compiled my kernel, so maybe it's enabled by default. Anyway, I
> thought this might be useful to know.
> 
> Oh yeah, the undelete feature only works with *unmounted* ext2
> partitions.
             
-------------------------------------------------------------------
Next Nomikai: 14 January 1999, 19:30 Tengu TokyoEkiMae 03-3275-3691
*** it will will be Jan 14 (Thu), as Jan 15 (Fri) is a natl holiday
Next Technical Meeting: Feb 13 (Sat), 12:30    ace: Temple Univ.
-------------------------------------------------------------------
more info: http://tlug.linux.or.jp                     Sponsor: PHT