1

how to recover a .c file in AIX unix which has removed (rm -f) by accidentally

2 Answers2

3

Just grab it from your daily/weekly backups

You have backups right?

Coincidentally, there is an FAQ at FAQS for this. Follow directions at your own peril...

Dan McGrath
  • 380
  • 1
  • 11
  • Deleted file has not checked in CVS server yet. It's newly created file. –  Feb 04 '10 at 13:46
3

If your FS is not journal-enabled and you remember any "unique" string in the content of the file you can use as a search seed a simple way is to:

  • mount the partition ro (or unmount it, if it is possible) in order to avoid accidental overwrite of the sectors involved
  • grep the partition device for the string you really know the deleted file has to contain

Of course you have to adjust -B and -A grep options, in order to be able to retrieve the entire file (set the lines before and after the searching string you have to grep). Redirect grep output on a new file and adjust it to remove exceeding heading and trailing lines.

I used this method a number of times, with very good results. 

grep -i -B 1000 -A 1000 \
      "your seed string you are really sure to find in the deleted file" \
      /dev/your-device-partition
drAlberT
  • 10,949
  • 7
  • 39
  • 52