Sometimes I am stupid. Then again, it doesn't matter, because I am lucky!
I am working on changing BartleBlog so it can be used from scratch. That may sound odd but because I have been using it since day 2 to post this blog, it has grown very organically, meaning there are things that only work because of the way I used it while developing it.
So, I created a test user, and created a test blog there, and I am working, and decide to do another from-scratch test, and...
I deleted my production copy.
Yes. The one that generates this blog. So this blog disappeared. Because I used the wrong terminal window.
And I had one-week old backups.
So I felt very very stupid.
Because undeleting in Linux is a joke.
So I was thinking how to spend a few hours recreating the last week of posts, and whatever, when I noticed on the taskbar... bartleblog was still running.
Which means that the DB was still open by a process. Which means...
[ralsina@monty bartleblog]$ ps ax | grep python 17063 pts/1 S 24:33 python bartleblog.py 17161 ? S 0:04 konqueror [kdeinit] -mimetype text/html http://www.google.com/search?q=python+copy+file&ie=UTF-8&oe=UTF-8 17454 pts/1 D+ 0:00 grep python [ralsina@monty bartleblog]$ su Password: [root@monty bartleblog]# cd /proc/17063/fd [root@monty fd]# ls 0 1 10 11 12 2 3 4 5 6 7 8 9 [root@monty fd]# ls -l total 0 lrwx------ 1 ralsina users 64 2007-05-13 21:07 0 -> /dev/pts/1 lrwx------ 1 ralsina users 64 2007-05-13 21:07 1 -> /dev/pts/1 lrwx------ 1 ralsina users 64 2007-05-13 21:07 10 -> socket:[159486] lrwx------ 1 ralsina users 64 2007-05-13 21:07 11 -> socket:[159488] lrwx------ 1 ralsina users 64 2007-05-13 21:07 12 -> /mnt/centos/home/ralsina/.bartleblog/blog.db (deleted) lrwx------ 1 ralsina users 64 2007-05-13 21:07 2 -> /dev/pts/1 lr-x------ 1 ralsina users 64 2007-05-13 21:07 3 -> /mnt/centos/home/ralsina/Desktop/proyectos/bartleblog/bartleblog/BartleBlog/ui/bartleblog.py lr-x------ 1 ralsina users 64 2007-05-13 21:07 4 -> pipe:[159481] l-wx------ 1 ralsina users 64 2007-05-13 21:07 5 -> pipe:[159481] lr-x------ 1 ralsina users 64 2007-05-13 21:07 6 -> pipe:[159482] l-wx------ 1 ralsina users 64 2007-05-13 21:07 7 -> pipe:[159482] lr-x------ 1 ralsina users 64 2007-05-13 21:07 8 -> pipe:[159485] l-wx------ 1 ralsina users 64 2007-05-13 21:07 9 -> pipe:[159485] [root@monty fd]# cp 12 /root/db [root@monty fd]# ls -l ~/db -rw-r--r-- 1 root root 3582976 2007-05-13 21:07 /root/db [root@monty fd]# sqlitebrowser ~/db [root@monty fd]# cp ~/db /home/ralsina/.bartleblog/blog.db
And I got the database back.
If you don't understand how that worked.... here's the explanation:
On unix, files are really unlinked (removed from directories) when no process has them open. Even then, the data is not deleted, but finding it is much harder.
On /proc/PID you can see the file descriptors each process has open.
You can actually copy a file descriptor.
So I went and copied the open file. And got it back. And this blog didn't go away.
So I am lucky! Stupid. But lucky!
There are various undelete tools too, though it really depends what filesystem you happen to be using since obviously the tool would need to be different for each one.
And then there is the proactive option of using libtrash, which intercepts the calls to delete files and really moves them to the trash. :-)