Ooops How Do I Undelete

A Backup Article Contributed by Anand R

Need for Undeleting Files

Accidental and malicious file deletions are a fact of life. Without Undelete facility, restoring these files means a time-consuming, expensive restoration from tape backup. And if the file was created and deleted between backups, if the tape is corrupted, or if you have no backup system to begin with, your file is gone and you're out of luck. There are many files that bypass the recycle bin when deleted, including server files deleted by network user. Even these files has to be recovered.

In general undeleting allows you to restore files that may have been deleted. If a user deletes a file (whose undelete attribute is set) accidentally or if he deletes it and then changes his mind, he can recover back his valuable data using undelete.

Ms DOS Undelete

The undelete command is an external command that is available in MS DOS 6.0. This program / command was designed to only be ran in MS-DOS versions 5.0 to 6.22. If you have upgraded to Windows 95, Windows 98, Windows NT, or any other Operating system this command will not restore any information but may possibly cause additional issues with the Hard Drive if ran.

If you currently are running a different operating system it is recommended that you pay a third party to restore the information from your Hard Drive. The UNDELETE command can only recover deleted files if no new files or changes have been made on the disk since the deletion. Therefore, if you accidentally delete a file that you want to keep, stop what you are doing immediately and use the UNDELETE command to retrieve the file.

Undelete in Linux

Currently the undelete flag in Unix can be accessed in Unix using the chattr and the lsattr commands. The chattr command can be used to change the a file(s) extended attributes. This command can manipulate among other attributes the attribute 'u' for file undeletion. The lsattr command can be used to list a file(s) extended attributes. As the man page for the chattr command puts it : When a file with the 'u' attribute set is deleted, its contents are saved.

This allows the user to ask for its undeletion This implementation will use the undelete inode. This inode is the reserved inode # 6. This inode can't have links to it except itself, so it will not be connected to anything in the filesystem. In this way this directory will be hidden from the rest of the system

Recovering from Undelete Directory (Linux)

The files with the undelete flag are copied to the undelete directory, the contents of the undelete directory can be listed, so the most important thing that was missing was the ability to recover files from the undelete directory. This was done by creating a function called undelete that receives the name of the file to be undeleted and proceeds to copy it either to the filesystem's mount point or to the path specified by the user, if he is the owner of the file.