how to recover a .c file in AIX unix which has removed (rm -f) by accidentally

Question

how to recover a .c file in AIX unix which has removed (rm -f) by accidentally

Answer 1

Just grab it from your daily/weekly backups

You have backups right?

Coincidentally, there is an FAQ at FAQS for this. Follow directions at your own peril...

Answer 2

If your FS is not journal-enabled and you remember any "unique" string in the content of the file you can use as a search seed a simple way is to:

• mount the partition ro (or unmount it, if it is possible) in order to avoid accidental overwrite of the sectors involved
• grep the partition device for the string you really know the deleted file has to contain

Of course you have to adjust -B and -A grep options, in order to be able to retrieve the entire file (set the lines before and after the searching string you have to grep). Redirect grep output on a new file and adjust it to remove exceeding heading and trailing lines.

I used this method a number of times, with very good results.

grep -i -B 1000 -A 1000 \
      "your seed string you are really sure to find in the deleted file" \
      /dev/your-device-partition