I am using Fedora Core 3. And I have accidentally deleted an important
file from the harddisk. How could I recover it, even not complete is
okay! (maybe a large part of it is useful. Thanks)
p.s. By the way, it was deleted by ANT, so it does not exist in the trash bin....
I tried the 'grep -a -B2 -A200 "xxxx" /dev/sda'  method, but it says
memory exhausted...
and not able to add too many hardware to it, since it is not my
computer, it's my organization's server.
Thanks in advance...

---

Request for Question Clarification by leapinglizard-ga on 26 Sep 2005 10:34 PDT

What kind of file system is installed on the disk partition containing
the deleted file? It's probably ext2 or ext3, but which one? There are
several courses of action open to you if it's ext2. With ext3, the
only thing you can do is grep for the file contents. If you have to
grep, I suggest that you do so using the longest phrase you can
remember from the document. Is it a text file, by the way?

leapinglizard

1.  Stop (or at least minimise) change on the affected filesystem until you have
    taken a copy of it.

2.  Copy that filesystem to somewhere you can work on it, which if you have
    sufficient space could be another FS on the same machine.
    (I've dome this with some success copying to another machine.)
    e.g.   dd if=/dev/hda5 of=/spare/recover/hda5.img bs=81920k

3.  Chop the image into pieces of manageable size and examine them to see
    which (if any) contain what you want.  For these tasks you can do much
    better than split and grep: have a look at
        http://www.notatla.org.uk/SOFTWARE/file_recovery/index.html