Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I came back to my machine, tried saving a file over ssh onto my linux server (CentOS).

It failed.

I wasn't interested in keeping any changes I had made so I closed my editor and reopened the file (over ssh).

The save attempt wiped the file.

I have made loads of changes to it since I last uploaded to revision control.

Seeing as it has just wiped the file I assume the data is still there. It's just a text file (php), is there any way of recovering it?

share|improve this question

4 Answers 4

up vote 1 down vote accepted
Seeing as it has just wiped the file I assume the data is still there.

I'm afraid you assume incorrectly. Depending on the filesystem and underlying device, the bytes that once made up the file might still live on disk, but it's going to be inaccessible to anything short of full-on forensic recovery, which I'm certain you don't want to pay for.

Have you checked your temp directory to make sure you don't have another copy laying around? Because you're probably not going to get that particular file back.

Sorry for the bad news.

share|improve this answer
    
Thanks for the help. –  user39234 May 26 '10 at 15:39
    
You might reconsider your post here, as it appears there's some details you're unaware of. –  Warner May 26 '10 at 15:39

If the inode was dereferenced, you might be able to recover the data. If the blocks were overwritten, it will require forensics recovery like Matt identified.

My preferred method is to use debugfs, which can be used to access inodes that have been dereferenced by not yet overwritten. The lsdel command is key. With some simple scripts, you can create hardlinks to all inodes output by lsdel and start groking the data.

There's also other tricks, such as grepping the filesystem or finding the inode using a different method.

Good luck and be careful. Low level utilities can easily produce disastrous results without caution.

share|improve this answer
    
Thanks for the help. I think I'll start writing it again... –  user39234 May 26 '10 at 15:39

Use PhotoRec. There you go. Had a problem once (Linux) where I deleted a partition that was being used as a Physical Volume in an LVM2 Volume Group, and did not have a backup of the /etc/lvm/backup file. PhotoRec solved it neatly, going over the deleted partition and recovering this file (a plain text file) for me, from where I was able to reconstruct the original configuration. Best of luck.

share|improve this answer
    
Wow cool, Open Source and multiple filesystems are supported. –  Warner May 26 '10 at 17:38

Here's a last resort suggestion - See if you can recover the file the editor had open on the local machine. I've done this before and was able to recover locally without having to try to do so on the server, which is busier and therefore more likely to reuse the disk space the file occupied.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.