It happens to everyone, deleting a important file by accident, being to quick. For me, it was a large configuration file for the Smokeping monitoring system, no backup available. It happened under Suse 10.3 Linux in the root partition with a ext3 filesystem. And I needed to recover it in 30 minutes to bring the application back online.

I checked the following tools available for file recovery in Linux:

1. recover-1.3c

URL: http://recover.sourceforge.net/linux/recover/

Unfortunately it works only for ext2 filesystems, no chance on ext3, I tried.

2. Midnight Commander

Undelete function likewise works only on ext2 as described. A user reported success using it on ext3, but didn't work for me, as expected.

3. ext3grep-0.6.0

URL: http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html

Most promising, excellent documentation. However, didn't work correctly on a mounted partition. Checked quickly if it was in Knoppix or another live Linux, but I found no info. It would have taken to long and I did not dare to shut down and try.

4. magicrescue-1.1.5

URL: http://jbj.rapanden.dk/magicrescue/

This one did the trick. Yes!!! It comes with recovery recipies for mp3 and pictures. I copied the one recipe for perl to 'ss' and adjusted it to match an ascii string I knew would be in the config file. Then I created the recovery files directory /home/fm/recover and run: 

magicrescue -b 1 -d /home/fm/recover -r ss /dev/sda2

I got 227 files recovered, and a quick grep in them showed my config file was among them! 

cd /home/fm/recover; grep smokeping *
...
00000B04F12B-0.:smokeping/images
00000B04F12B-0.:datadir  = /home/smokeping/data
00000B04F12B-0.:smokemail = /home/smokeping/etc/smokemail
00000B04F12B-0.:cgiurl   = http://localhost/smokeping/cgi-bin/smokeping.cgi
00000B04F12B-0.:tmail = /home/smokeping/etc/tmail
00000B04F12B-0.:template = /home/smokeping/etc/basepage.html
000022004E3F-0.:smokeping/echoping-6.0.2/conftest.c:53: undefined reference to `shl_load'
000022004E3F-0.:/home/dev/smokeping/echoping-6.0.2/conftest.c:53: undefined reference to `dlopen'
000022004E3F-0.:/home/dev/smokeping/echoping-6.0.2/configure:9048: warning: Using 'dlopen'
 in statically linked applications requires at runtime the shared libraries from the glibc
 version used for linking
000024846496-0.:smokeping/echoping-6.0.2/conftest.c:38: undefined reference to `pow'
...

A quick view showed the recovered config file named 00000B04F12B-0. was almost fully intact, just a few lines missing on the top from the ** General ** section, easy to replace.

After further reading I found this way which I believe would have worked too: http://recover.sourceforge.net/unix/ Maybe worth to try next time. Not sure how well it works for non-ASCII files.

Phew. Close call. Safe again. :-)