Introduction
It happens to everyone, deleting a important file by accident, being to quick. For me, it was a large configuration file for the Smokeping monitoring system, no backup available. It happened under Suse 10.3 Linux in the root partition with a ext3 filesystem. And I needed to recover it in 30 minutes to bring the application back online.
I checked the following tools available for file recovery in Linux:
1. recover-1.3c
URL: http://recover.sourceforge.net/linux/recover/
Unfortunately it works only for ext2 filesystems, no chance on ext3, I tried.
2. Midnight Commander
Undelete function likewise works only on ext2 as described. A user reported success using it on ext3, but didn't work for me, as expected.
3. ext3grep
URL: http://code.google.com/p/ext3grep/
Most promising tool (ext3grep-0.6.0), with excellent documentation. However, didn't work correctly on a mounted partition. I checked quickly if it was available in Knoppix or another live Linux, but I found no info. It would have taken to long and I did not dare to shut down and try.
4. Magic Rescue
URL: http://www.itu.dk/people/jobr/magicrescue/
This one (magicrescue-1.1.5) did the trick. Yes!!! It comes with recovery recipies for mp3 and pictures. I copied the one recipe for perl to 'ss' and adjusted it to match an ascii string I knew would be in the config file. Then I created the recovery files directory /home/fm/recover and run:
magicrescue -b 1 -d /home/fm/recover -r ss /dev/sda2
I got 227 files recovered, and a quick grep in them showed my config file was among them!
cd /home/fm/recover; grep smokeping * ... 00000B04F12B-0.:smokeping/images 00000B04F12B-0.:datadir = /home/smokeping/data 00000B04F12B-0.:smokemail = /home/smokeping/etc/smokemail 00000B04F12B-0.:cgiurl = http://localhost/smokeping/cgi-bin/smokeping.cgi 00000B04F12B-0.:tmail = /home/smokeping/etc/tmail 00000B04F12B-0.:template = /home/smokeping/etc/basepage.html 000022004E3F-0.:smokeping/echoping-6.0.2/conftest.c:53: undefined reference to `shl_load' 000022004E3F-0.:/home/dev/smokeping/echoping-6.0.2/conftest.c:53: undefined reference to `dlopen' 000022004E3F-0.:/home/dev/smokeping/echoping-6.0.2/configure:9048: warning: Using 'dlopen' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking 000024846496-0.:smokeping/echoping-6.0.2/conftest.c:38: undefined reference to `pow' ...
A quick view showed the recovered config file named 00000B04F12B-0. was almost fully intact, just a few lines missing on the top from the ** General ** section, easy to replace.
After further reading I found this way which I believe would have worked too: http://recover.sourceforge.net/unix/ Maybe worth to try next time. Not sure how well it works for non-ASCII files.
Phew. Close call. Safe again. :-)