Linux: Recovering files from /filespace home directories and group shared space.
This document describes how to recover lost or deleted files from /userspace home directories and /groupspace group shared space.
Note that the # character at the beginning of each command line is not part of the command and should not be included in the command.
Traditionaly, when you delete, remove (
rm), rename, or move
mv) a file in Unix the operation cannot be undone because of the
way that it modified the underlying filesystem. However, recent volume managers
allow one to take
or checkpoints of how a filesystem looked at a given point in time. These can
function as simple file recovery aids, though aren't
suitable for disaster recovery.
Restoring Files from
/userspace storage system there are now several levels
of read-only snapshots to choose from. The snapshots are accessible by users in any sub
directory in your home directory or group space by navigating to the hidden
.ckpt directory. Within this directory are a series of dated
subdirectories that indicate the time the snapshot was taken. These
subdirectories are of the form
YEAR_MONTH_DATE_HOUR.MINUTE.SECOND_TIMEZONE. You can browse
through each of them at your leisure until you find the appropriate file, then
cp it back to the original location or a new one.
For example, say one wanted to restore a script called
colortable16.sh they had been working on in
directory from a couple days ago.
# cd ~/tmp # ls -1a ./ ../ 6200-5400-3500-CLI-k1201-Feb2007.pdf preexec.bash vi3_35_25_u2_admin_guide.pdf
Notice that there is no
.ckpt directory listed, however it is there ...
# cd .ckpt # ls -1a ./ ../ 2009_11_22_00.01.01_America_Chicago/ 2009_11_29_00.01.00_America_Chicago/ 2009_12_06_00.01.01_America_Chicago/ 2009_12_09_00.01.00_America_Chicago/ 2009_12_10_00.01.01_America_Chicago/ 2009_12_11_00.01.01_America_Chicago/ 2009_12_12_00.01.01_America_Chicago/ 2009_12_13_00.01.01_America_Chicago/ 2009_12_14_00.01.01_America_Chicago/ 2009_12_14_12.01.01_America_Chicago/ 2009_12_14_15.01.01_America_Chicago/ 2009_12_14_18.01.01_America_Chicago/ 2009_12_14_21.01.01_America_Chicago/ 2009_12_15_00.01.01_America_Chicago/ 2009_12_15_03.01.02_America_Chicago/ 2009_12_15_06.01.01_America_Chicago/ 2009_12_15_09.01.00_America_Chicago/
Our current snapshot schedule is the following, though it is subject to change:
Every 3 hours for the last day.
Every day at midnight for the past 7 days.
Every Sunday at midnight for the past 4 weeks.
At this point if I know the time I want to recover from I can simply enter the directory and copy it to a new location like so:
# cp 2009_12_06_00.01.01_America_Chicago/colortable16.sh ~/tmp/colortable16.sh.restored
However, I could also use the following command to see when it last appeared, and then review from that list:
# find . -name colortable16.sh ./2009_11_22_00.01.01_America_Chicago/colortable16.sh ./2009_11_29_00.01.00_America_Chicago/colortable16.sh ./2009_12_06_00.01.01_America_Chicago/colortable16.sh ./2009_12_09_00.01.00_America_Chicago/colortable16.sh
Now I can review some of the candidates and decide to copy one back to my
# less ./2009_12_09_00.01.00_America_Chicago/colortable16.sh # less ./2009_12_06_00.01.01_America_Chicago/colortable16.sh # cp ./2009_12_06_00.01.01_America_Chicago/colortable16.sh ~/tmp/
Recall that the snapshots under the
.ckpt directories are
read-only, so at this point one can go back to
~/tmp to begin
working on the file again:
# cd ~/tmp/ # vim colortable16.sh