It happens to everyone, deleting a important file by accident, being to quick. For me, it was a large configuration file for the Smokeping monitoring system, no backup available. It happened under Suse 10.3 Linux in the root partition with a ext3 filesystem. And I needed to recover it in 30 minutes to bring the application back online.

I checked the following tools available for file recovery in Linux:

1. recover-1.3c


Unfortunately it works only for ext2 filesystems, no chance on ext3, I tried.

2. Midnight Commander

Undelete function likewise works only on ext2 as described. A user reported success using it on ext3, but didn't work for me, as expected.

3. ext3grep


Most promising tool (ext3grep-0.6.0), with excellent documentation. However, didn't work correctly on a mounted partition. I checked quickly if it was available in Knoppix or another live Linux, but I found no info. It would have taken to long and I did not dare to shut down and try.

4. Magic Rescue


This one (magicrescue-1.1.5) did the trick. Yes!!! It comes with recovery recipies for mp3 and pictures. I copied the one recipe for perl to 'ss' and adjusted it to match an ascii string I knew would be in the config file. Then I created the recovery files directory /home/fm/recover and run:

magicrescue -b 1 -d /home/fm/recover -r ss /dev/sda2

I got 227 files recovered, and a quick grep in them showed my config file was among them!

cd /home/fm/recover; grep smokeping *
00000B04F12B-0.:datadir  = /home/smokeping/data
00000B04F12B-0.:smokemail = /home/smokeping/etc/smokemail
00000B04F12B-0.:cgiurl   = http://localhost/smokeping/cgi-bin/smokeping.cgi
00000B04F12B-0.:tmail = /home/smokeping/etc/tmail
00000B04F12B-0.:template = /home/smokeping/etc/basepage.html
000022004E3F-0.:smokeping/echoping-6.0.2/conftest.c:53: undefined reference to `shl_load'
000022004E3F-0.:/home/dev/smokeping/echoping-6.0.2/conftest.c:53: undefined reference to `dlopen'
000022004E3F-0.:/home/dev/smokeping/echoping-6.0.2/configure:9048: warning: Using 'dlopen'
 in statically linked applications requires at runtime the shared libraries from the glibc
 version used for linking
000024846496-0.:smokeping/echoping-6.0.2/conftest.c:38: undefined reference to `pow'

A quick view showed the recovered config file named 00000B04F12B-0. was almost fully intact, just a few lines missing on the top from the ** General ** section, easy to replace.

After further reading I found this way which I believe would have worked too: Maybe worth to try next time. Not sure how well it works for non-ASCII files.

Phew. Close call. Safe again. :-)