Big Boo Boo

[Kurt Wall]

On Tue, Oct 26, 2004 at 07:26:40PM +1000, James McDonald took 22 lines to write:
> > On Mon, Oct 25, 2004 at 07:47:45PM -0500, Rick Sivernell took 24 lines to
> > write:
> >>
> >> Accidently rm -r /<dir> and all of it's contents, is there a way or
> >> command to
> >> restore the files. the directory is on a partition of it's own and no
> >> other data
> >> is there.
> >
> > Nope. Unless you have backups, you're toast. Think twice; type once...
> 
> If the unlink system call is simply removing a pointer to a file that
> still exists on the hd why is that the final call? isn't it possible to
> get below the file system and see what data is still on the disk?

You can get below the file system, but you don't have much time. I'm not
persuaded the undeletion is worth the effort, because you don't usually get
back all of what you lost, much less what you *have* to get back, and I
wouldn't trust the integrity (lack of corruption) in what I did get back.

It's effectively the final call because:
1) Most Linux FSes actively reclaim free disk space
2) The inodes get resued
3) FS data is cached, so the VFS layer writes data out periodically 
   to flush the cache

Kurt
-- 
If you think the United States has stood still, who built the largest
shopping center in the world?
	-- Richard M. Nixon