Undelete In Linux

Manuel Arriaga writes "[To the editors: I am not a professional programmer, nor will I ever be one. My income does not depend on my computing/programming skills, and hopefully it never will. So promoting free software I wrote does not help me in any financial way, no matter how indirect. libtrash is free software (GPL2), and I distribute it for free from my website. I have nothing to gain from the increased exposure, except for knowing that I am helping others. And I know slashdot isn't freshmeat... With that out of the way:] I have seen this topic discussed in the LKML multiple times by now, and many more people asking in the newsgroups why "I can't recover my deleted file on GNU/Linux". Here is my answer to that question. libtrash gives Linux a real "trash can". And it has been doing so (with varying degrees of stability) for more than one year now. If you consider it appropriate, make this information public on slashdot."

Comments

Recycle Bins - don't you just hate them?

[fruey]

Reasons you don't need a recycle bin:

• Because rm doesn't take -f by default
• Because delete means delete, not put somewhere until I decide I really don't need it
• Because you're a Linux user and have a clue
• Because you're sick of people who restore files from the recycle bin because they think it's some kind of temporary folder
• Because you don't want anything to do with "recycling", you have /dev/null and you put everything there
• Because you have a poor machine with less than 4Gb of disk and you need all the space you can get

I can't believe how many Windows users get caught out when they dual boot my machine into Windows (have to have it for the office because others use my workstation) and find I have disabled the Recycle bin. Haha, more fool them.

Disclaimer: take with a pinch of salt. If you have sodium issues, take with a pinch of Lo-Salt instead.

Re:Recycle Bins - don't you just hate them?

[Coplan]

A friend of mine once told me that he would start using linux when they had a trash can type of thing. His reasoning was that he liked to make sure that his files weren't needed. He'd delete something, then wait about a week or so of regular computer usage before removing it from the "recyle bin". For him, this type of tool is very useful.

If we want joe-user to use linux, we need silly stuff like this.

For you and I (and those in the know), we know damn well that you can delete a JPEG without it affecting anything. And if we're in doubt about a file, we know to move it somewhere temporarily. If something breaks, move it back. It's not all that often that you'll be deleting system files (and even then, its usually configuration files).

Anyhow, I guess the reality is that a tool like this only needs to be useful to someone. If it is useful to a couple of people, then its worthy of its existence. It's not like it is a default application. Don't use it if you don't want it. That's the beauty of the Open Source world...you can do what you want.

Re:Recycle Bins - don't you just hate them?

[Transient0]

It is nice to be able to have the cheap sense of superiority that comes with not needing something that someone else needs. Of your reasons, only one is valid that I see:

>Because you have a poor machine with less than 4Gb of disk and you need all the space you can get

But still, no matter how long you've been a linux user it's still possible to accidently type "rm core *" rather than "rm core*" and not catch it until half a second after you hit enter and realize that you have irrecoverably destroyed your project(you didn't really want to punish it for segfaulting).

linux on the desktop

[redhotchil]

now we have almost everything we need:

[x] Trashcan support
[ ] Easy to use Windowing system
[ ] Standard software install system
[ ] Easy to use Windows filesharing
[ ] Easy support for video files and DVD
[ ] Desktop company support

Way to go LINUX!

Where's your sense of danger???

[netphilter]

Come on, recycle bins are no fun at all. Where's the fun in having the files you "delete" stored in a folder until you REALLY want to delete them. It's much more fun to delete files knowing that there's a chance you may need them in the future and have no way of retrieving them (unless you're responsible and back your files up, but then again, what's fun about being responsible?).

So everyone is perfect?

[GreyyGuy]

I don't understand why there are so many people saying this is bad or implying that people who use Linux don't need it because they are so good. I must have missed the evolutionary step that made all Linux users so perfect that they never make mistakes. That is all the Recycle Bin is.

Sure, some people use it as temporary folder, but so what? There will always be people who use things other then the way they are intended. If it works for them, so what? If it is so painful for you to contemplate, don't look at it.

Re:So everyone is perfect?

[Znork]

Because a lot of us _mean_ rm when we type rm. Otherwise we would have used mv. Or used Nautilus or some other filemanager that by default puts stuff in the trashcan.

rm means 'remove'. Not 'move to trash'. Think of it as the 'empty trashcan' command. Would you like a trashcan that moves things to yet another trashcan when you empty it?

If you're uncertain about wether or not to remove something dont use rm. You're entirely free to rm /bin/rm if you dont want to use it. Or even mv /bin/rm /tmp if you're uncertain about wether or not to remove it permanently.

And if you, despite knowing that rm means 'remove', make a mistake, just restore from your backups.

Re:So everyone is perfect?

[bacchusrx]

Would you like a trashcan that moves things to yet another trashcan when you empty it?

Well, that is--more or less--the way that actual trashcans operate ;)

bacchusrx.

I know you're kidding, but....

[FreeLinux]

[x] Trashcan support
[X] Easy to use Windowing system - KDE
[X] Standard software install system - LSB, Red Hat, Mandrake, Suse
[X] Easy to use Windows filesharing - KDE, Samba
[ ] Easy support for video files and DVD - No answer
[X] Desktop company support - Red Hat, The Kompany

Re:I know you're kidding, but....

[oever]

[X] Easy support for video files and DVD - mplayer

I've installed mplayer on two SuSE 8.0 linux machines, and it's amazing. You can see DVD's, AVI's and even look at at microsoft media streams.
e.g. 'mplayer mms://streaming.omroepbrabant.nl/live1'

And how easy do you want it? You can easily make an icon on the desktop that starts mplayer on the dvd currently in the drive.

So, visit www.mplayerhq.hu and rejoice.

Re:I know you're kidding, but....

[Josuah]

[X] Easy to use Windowing system - KDE

Um, KDE is really nice and my windowing system/manager of choice under Linux. But it's really not so "easy to use" "all the time" to the degree that Windows and Mac OS are.

[X] Standard software install system - LSB, Red Hat, Mandrake, Suse

By listing four things here, you've gone right ahead and said that the software install system is _not_ standard. There is a very different user experience for each distribution's install, enough to make the average user think he is installing a different OS for each one. I know my mom thinks Red Hat is an OS.

[X] Easy to use Windows filesharing - KDE, Samba

I can't say Samba is easy to use Windows filesharing. Easy to use Windows filesharing is clicking on a button that says share files and seeing that folder show up in Network Neighborhood. It's not SWAT.

Re:I know you're kidding, but....

[Fastball]

[X] Easy to use Windowing system - KDE

You mean GNOME, right?

Recycle Bin vs Trash Can

[chill]

Way back when Apple sued Microsoft for ripping off the look of their interface, Apple lost. The ONLY thing they got the judge to concede was the Trash Can was theirs. Thus, MS changed to a recycle bin -- a sideswipe at the Apple-California neo-environmental stereotype.

The editorial cartoons of the time were great. One showed a picture of Jobs carrying a trashcan full of legal documents with someone commenting "At least the judge let you keep something to carry all that home in."

Not a solution

[cpt kangarooski]

While a trash can is nice to have, this doesn't fundementally address the issue of retrivability of accidently deleted information. That is, there is still going to be a step where information is going to be classed as unretrivable even when it COULD be retrieved. (i.e. when the trash is emptied)

Clearly users appear to want to be able to correct mistakes that they've made -- perhaps even those that were not immediately apparent as being mistakes at the time -- for as long as possible. A trash is a step in that direction, but simply does not go far enough.

My proposal is this: 1st it should be recognized that when you delete a file, you're really only marking the space where that file was as being available to be overwritten by more data. The original data is there, but what it consisted of, and where it was, are lost.

So, let's keep that information in a log so that we can in a very real sense undelete anything that has not yet been overwritten. This log is not especially large, and with modern drive sizes is not a serious concern.

Then, let's order the overwriting process to favor the maximum preservation of data. So for example this might result in new writes being done to the areas of the oldest deleted files first. Important files might be considered to be worth preserving longer, with importance dervived from various factors such as number of accesses, etc. prior to deletion. There's definately work for some user testing here to determine the optimal method. That's okay.

If fragmentation is a worry, (bear in mind most people have never heard of it) then defragging software could take into consideration the undelete log and continue to preserve as much of the deleted data as possible when it shifts information around on the disk.

In any event, the objective is to forestall the day when you have to tell a user who wants to undelete a file for as long as possible. Not longer, which the trash solution does, but AS LONG AS POSSIBLE.

False sense of security

[Myshkin]

So, what happens if you send something like ld.so, or your kernel into the recycling bin? Experimenting by randomly moving stuff you don't understand is never a good idea. Just sending it to some sort of recycling bin just gives folks a false sense of security and could lead them to completely hosing their entire install.

Linux needs this at the filesystem level ... NOW

[krray]

I've been a rabid Linux user from the early days. Today Linux handles DNS, Email, and Web services on my networks...it does NOT handle file access for JUST THIS REASON (lack of undelete).

I'm not worried about *me*. When I delete something I fine with it being completely gone. What about completely clueless network users though? Being the MIS/IT MGR for where I work having access to "salvage" on the Novell Netware file servers is a wonderful tool for users mistakes.

Classic example: last week one user created a Excel spreadsheet to be completed by another user. The second user opened the spreadsheet from Word, modified it, and saved it (as a .XLS file). Excel says it's corrupt (it's a Word document now).

Getting the inserted table [spreadsheet] from Word back into Excel was next to impossible. Crappy Microsoft programming as usual -- and clueless users to boot. Easiet solution was to salvage the original spreadsheet and instruct user what NOT to do and re-enter the damn data PROPERLY this time.

Linux would have left me high and dry. Well, not really, but having to go back to tape backups to simply salvage one file is a pain in the butt.

I guess Linux will be nothing more than a niche product/market if "gurus" keep their attitudes posted here. Wake up and pay attention to corporate users and admins wants/needs. Telling me I'm clueless and wrong won't gain more market share (well, for Linux at least) -- I've recently bought another Netware license to cover just this issue for another remote office.

I'm Torn

[ReadParse]

I know in my heart that there's no need for this on Unix, because you shouldn't run as root AND use rm -rf and THE decide that you shouldn't have done that. There are safeguards in place and, after all, since you're a Linux superuser, you're either good enough that you don't make that kind of mistake or the system isn't important enough for it to really matter.

Having said that, even though I know how dumb it was, I once accidentally issued `rm -rf /bin`. Funny story, though:

For some reason or another, I happened into an additional hard disk that I put into my Linux box at work (not a production box). I don't remember how big it was, but it was big enough relative to my primary disk that, when I needed a mount point, I chose /big. That was the first mistake. I have no idea why I felt the need to mount it that close to the root. Although the similarity between "big" and "bin" is obvious in retrospect, it is, after all, retrospect.

Actually, that wasn't my first mistake. My first mistake was running as root.

I mounted the disk and played around with it. I suspect that it was my first time playing around with an additional hard disk, so I copied files over and examined "df -k" and so forth, and eventually I guess I decided to unmount it and do it all over again... I probably would have done endless, mindless file copies for the rest of the day, I was so thrilled with it. Hey, I was young.

This is where it gets embarassing. Perhaps everybody has some mysterious glitch which adds confusion where there should be none. Yes, I honestly do know the difference between a symlink and a mount... I swear it. But in the very brief period of time that it takes to type a command, I sometimes confuse the two in my mind and try to unmount using the "rm" command. More specifically, "rm -rf".

I also noticed on that day that we humans have kind of a built-in autocompletion. If you type the first few letters of your last name, you have a tendency to follow through with the rest of it. And that tendency increases dramatically the closer you get to the last letter. The way I noticed this was when I attempted to issue `rm -rf /big` and immediately pressed return (I found that return is also a mysterious part of that autocompletion).

Just so you know, there are a great many important things in /bin. Among them, all of the shells, chmod/chown, grep, kill, ls (try working without that), mv.... the list goes on and on.

This story also reminds me of the time I evaluated WS_FTP Server when it first came out. I needed an FTP server so I could go home and work on some files on an NT server. I wanted access to the whole box, so I set up my FTP account's home directory as c:\ -- I had no idea that when I deleted that account it would attempt to delete the user's home directory, even if it was c:\.

I've never heard a disk thrash like that before or since. And you've never seen anybody turn a box off as quickly as I did when I realized what was going on. Alas, it was too late. Reinstallation and backup restore (yes, I had a backup) commenced immediately. By the way, I've never fully accepted responsibility for that -- I still feel like it should have said "You're about to delete c:\ and all of it's subdirectories. Are you sure?" Because I really didn't think it would do that.

Anyway, my point is that "there, but for the grace of a godlike substance, go you". It's really easy to say we're too good for this, and there's a damn good case that a linux trashcan is not necessary, but for those who want it I think it's a cool piece of code.

That is all.

RP

safedelete

[oneeyedman]

After losing eight hours of editing work during a botched backup attempt, I heard about a utility called safedelete. I can't find much on it, but here it is from Ibiblio. Interestingly, the person that told me about this utility (which sets up a trash directory with timed expiration and a system of aliases for rm and related commands) was an old Unix hand, and only secondarily a Linux user. The program works fine in Debian, I can report.

And I don't get these people saying they are too smart to need an undelete capability. Must be nice!

No, I don't.

[Rui del-Negro]

Technically, you can use a pint mug to drink champagne. But most people prefer to use a champagne glass or a flute.

Personally, I prefer to simply hit "delete" to move files to a preset temporary directory (which can also remember where those files originally were, and restore them with a couple of clicks) than to have to manually drag them to a directory I created.

If this kind of "commodity" seems pointless to you, then you probably program by writing machine code with a text editor. ;-)

RMN
~~~

The TCT

[schlach]

I can't believe no one's mentioned The Coroner's Toolkit. Written by Dan Farmer and Wietse Venema, those crazy kids that wrote SATAN, back in the day. It has all kinds of fun tools for poking around backstage on a *nix box, ostensibly forensics-related work after a machine compromise, but if you accidentally delete something important, you could pretend that someone else broke in and did it. =)

From the FAQ:

What the hell is it? The Coroner's Toolkit (TCT) is a collection of tools designed to assist in a forensic examination of a computer. It is primarily designed for Unix systems, but it can [do] some small amount of data collection & analysis from non-Unix disks/media.

Features: Notable TCT components are the grave-robber tool that captures information, the ils and mactime tools that display access patterns of files dead or alive, the unrm and lazarus tools that recover deleted files, and the findkey tool that recovers cryptographic keys from a running process or from files.

"Take this object, but beware! It carries a terrible curse!"

The advantage is has over some recovery options is that it's entirely post-mortem. If you just deleted the boss's laundry-list, you could go download it, build it, and stand a pretty decent chance of recovering your file.

The disadvantage is that, perhaps like a real autopsy, it's not for the faint of heart...

I don't think this is the right solution...

[Ender Ryan]

I don't think this is the proper solution. There are a lot of programs that create temp files and unlink them, so something like this is going to really clutter up a filesystem really quick.

I think underlete should be handled at the application level, ie. in konqueror and nautilus, etc. Maybe alias rm to something else for the command line.

Why not do it for real?

[Salamander]

It shouldn't be all that hard to do this in-kernel, so it doesn't have library-preload dependencies or side effects and catches even stuff that comes into the kernel from unexpected directions. All you need is a dirt-simple filter driver that you push on top of the filesystem to change delete/unlink calls so they move stuff into the trashcan, plus some ioctls to view/empty it.

Oh, wait, Linux doesn't have filter drivers. For a moment there I forgot we were talking about a "technically superior" OS.