Re:

> [email protected] sez:
> > I accidentilly deleted some log files, do I have to install tct to try and
> > get them back?
> We would need more information to help you further. However as stated in the
> readme files, TCT is a complex and very powerful tool. There is a learning
> curve and other factors which would hinder in the fast recovery of your log
> files.
> 
> But yes, TCT would give you the tools you would need to recover log files
> from a Unix based system ( Linux, BSD, etc)

Linux *can* be much easier to recover stuff than UNIX, for various
reasons.  The reasons themselves are left as an exercise to the reader.

If you have certain versions of linux and have fls (brian carrier's cool
tool, search in google) and ils (tct) in your path, here's a little perl
script I use to undelete files (it certainly works on redhat 6.1, but
linux changes so much I never tried to make it work for more systems.)
It shoves things to stdout, so you'll want to use it like

	$0 deleted-file-name > /dev/not/in/same/dev/as/deleted/file

(Not in the same device, so you don't blow away data that you're trying
to save.)  If you do want to try this take compiled versions of fls &
ils from a *different* machine so that your install and compile won't
blow data away as well.  As always, move as quickly as possible and
don't disturb your data.

You can test this out by doing something like:

	# echo hello, world > test-file
	# cat test-file
	hello, world
	# rm test-file
	# ./undelete.pl test-file
	hello, world

YMMV, you get what you pay for, etc., etc., but it's saved *me*
a few times.  Norton it's not, but hey!  ;-)

If none of this works... there are other methods.  I wrote this up
with wietse awhile ago:

	http://www.fish.com/tct/help-recovering-file

-- d

#!/usr/local/bin/perl

#
# undelete a file under some versions linux in CWD
#
#	Usage: $0 filename
#
# NOTE: dependencies - requires ils & fls to be in your path
#       (and df and ls, but that probably won't be a problem ;-))
#
# NOTE TWO: do this quickly, or lose data!
#

die "$0 filename\n" if $#ARGV < 0 || $ARGV[0] =~ /\//;

chop($pwd = `pwd`);

# get the current dev
chop($dev = `df $pwd | awk '/\\// { print \$1 }'`);

# get the inode of the current dir
($x,$inode,$x) = lstat($pwd);

die "can't run fls\n" unless open(FLS, "fls -d $dev $inode|");
while ((($x,$x,$inode,$file) = split(/\s/, <FLS>))) {
	if ($file =~ /$ARGV[0]/) {
		if ($file eq $ARGV[0]) {
			$inode =~ s/://;
			print `icat $dev $inode`;
			exit 0;
			}
		}
	}

die "Couldn't undelete $ARGV[0]\n";

close(FLS);