It happens to everyone sooner or later: a split second after you hit Enter you realize your mistake, but it's too late; you just deleted a valuable file or directory for which no backup exists. Or maybe you have a backup, but it's a month old... and in shock you see the past month flash before your eyes as you realize in pain what you'll have to do all over again...


Fortunately, you remember that files are never really deleted, at most overwritten by new content. So, you remount the disk read-only as fast as possible. But now? On February 7th, 2008, Carlo Wood accidentaly deleted his whole home directory: over 3 GB of data, deleted with rm -rf. The only backup he had was from June 2007. Not being able to undelete was unacceptable. So, he ignored what everyone tried to tell him and started to learn how an ext3 file system really works, and what exactly happens when files are deleted... This is not for the faint of heart, though...


Taking backups may not allways be enough : sometimes, you better take a snapshot image of your boot partition (including /usr and /var), and your MBR. dd might be your friend, but be carefull about the block size. Freshmeat has an interesting article how to use partimage to create clones of partitions.