Tim here. There are two main time-periods in which you can do
something: before you delete the files and after you delete the
files.
Before you delete the files, you can do things like have a file-system
that supports fast/cheap snapshots and take snapshots every N
minutes, possibly using a snapshot-manager to take them multiple
times per hour, then keep one of those per hour, and keep one of
those per day, and one of those per week, and one of those per
month. I use ZFS on my FreeBSD box and snapshots are essentially
free (only costing the space used for a tiny bookmark record and
anything that gets deleted). I understand that BTRFS ("Butter FS")
has similar options. Note that the drive will continue to fill
even if you delete things because they reside in the snapshots. So
you have to winnow those snapshots over time. Or create different
snapshot timetables for different datasets. I snapshot my OS-level
folders before upgrading either my base-system or my packages, and
keep one or two of those snapshots around, but not a lengthy history
of them. I snapshot my home directory more frequently where files
are usually added, but I have a special data-set for my Mail directory
where things get frequently added-and-deleted (so I want those
deletions to actually get freed up pretty quickly)
Alternatively, you can use some
delete-to-a-trashcan-instead-of-actually-delete tool like Trashy
https://github.com/notklaatu/trashy
calling it whatever you prefer, like "del" if that's what you want.
If you're trying to recover files *after* you've deleted them without
precautions like above in place, you're looking at a lot more
heartache and pain. Especially if you use an encrypted drive.
There are some utilities that will scan the raw drive image (or
unencrypted drive virtual device) for certain file-type signatures.
I had impressive luck using "JPEG rescue"
https://www.ocf.berkeley.edu/~fricke/projects/jpegrescue/
to play the hero for a friend who had deleted a lot of her files.
I've also been able to scan through the raw hard-drive image for
text files (yet another reason I love plain-text for most of my
files), grepping for some known text. If the file is binary, your
chances are a lot lower.
So I strongly recommend snapshotting (and backups to external
devices, and testing those backups).
Hopefully this gives you a couple tools in your belt.
-tim
On 2023-03-26 08:13, Linux for blind general discussion wrote:
> Hi All: After many years of impulsive mistakes on my part, as well as other
> insodents, I would like to have a better way of recovering from these. As an
> ideal solution, I would like to alias a "del" command so files are moved to
> a scratch location for 6 hours, which would be more than enough time for me
> to realize I was impulsive about wild-cards. I am in TCSH Debian SID. At
> least years ago in DOS I could run an undelete command, it would ask for a
> first letter to fillin. Also, years ago when I was on PrimeNet, we could cd
> in to a "snapshot" directory where everything would still be around. My
> Linux expert says at 1 point we tried a similar solution of butter fs but he
> says I didn't like it as it was filling up my hard-drive. Seemingly just
> keeping deleted files around for 6 hours would be a perfect solution. We are
> also planning on upgrading hard-drives on a local backup server. Thanks so
> much in advance for suggestions.
> Chime
>
> _______________________________________________
> Blinux-list mailing list
> Blinux-list@xxxxxxxxxx
> https://listman.redhat.com/mailman/listinfo/blinux-list
>
_______________________________________________
Blinux-list mailing list
Blinux-list@xxxxxxxxxx
https://listman.redhat.com/mailman/listinfo/blinux-list