UNIX FAQ Version 2.1 92/12/04 -- Question 3.6

How do I "undelete" a file?

Someday, you are going to accidentally type something like "rm * .foo", and find you just deleted "*" instead of "*.foo". Consider it a rite of passage. Of course, any decent systems administrator should be doing regular backups. Check with your sysadmin to see if a recent backup copy of your file is available. But if it isn't, read on. For all intents and purposes, when you delete a file with "rm" it is gone. Once you "rm" a file, the system totally forgets which blocks scattered around the disk comprised your file. Even worse, the blocks from the file you just deleted are going to be the first ones taken and scribbled upon when the system needs more disk space. However, never say never. It is theoretically possible *if* you shut down the system immediately after the "rm" to recover portions of the data. However, you had better have a very wizardly type person at hand with hours or days to spare to get it all back. Your first reaction when you "rm" a file by mistake is why not make a shell alias or procedure which changes "rm" to move files into a trash bin rather than delete them? That way you can recover them if you make a mistake, and periodically clean out your trash bin. Two points: first, this is generally accepted as a *bad* idea. You will become dependent upon this behaviour of "rm", and you will find yourself someday on a normal system where "rm" is really "rm", and you will get yourself in trouble. Second, you will eventually find that the hassle of dealing with the disk space and time involved in maintaining the trash bin, it might be easier just to be a bit more careful with "rm". For starters, you should look up the "-i" option to "rm" in your manual. If you are still undaunted, then here is a possible simple answer. You can create yourself a "can" command which moves files into a trashcan directory. In csh(1) you can place the following commands in the ".login" file in your home directory: alias can 'mv \!* ~/.trashcan' # junk file(s) to trashcan alias mtcan 'rm -f ~/.trashcan/*' # irretrievably empty trash if ( ! -d ~/.trashcan ) mkdir ~/.trashcan # ensure trashcan exists You might also want to put a: rm -f ~/.trashcan/* in the ".logout" file in your home directory to automatically empty the trash when you log out. (sh and ksh versions are left as an exercise for the reader.) MIT's Project Athena has produced a comprehensive delete/undelete/expunge/purge package, which can serve as a complete replacement for rm which allows file recovery. This package was posted to comp.sources.misc (volume 17, issue 023-026)