Accidentally Removed from File

Question

I am editing in vi

I tried to copy a small part of my paper into a temp file

.,.+40!temp.

But I wrote

.,.+40!.

So this removed everything in the important things in the file (other than those 40 lines). Is there any way that I could retrieve the file that I had originally had (about 30 pages) or would I have to start from scratch?

Duh. I just received two comments: thank you very much! I lost my contact with the website. Yes, if I had still been on the editing page I would have no trouble. But the machine "decided" that I was finished editing this paper (so I wound up with the "bad one" — Guest, Oct 15 '15 at 19:05

score 4 · Answer 1 · edited Apr 13 '17 at 12:36

I am not familiar with the command you've used, but if you have not exited from vi, the U command should undo the change.

Otherwise, in decreasing order of desirability:

In some cases a previous version of the file will be saved as filename.ext~ (probably it's not your case or you'd not even have posted, but still worth a try).
Previous versions of the file and its swap might be recoverable using extundelete, if your filesystem allows it (ext3 or ext4). If only the swap is recoverable, strings can be used to extract large swaths of text. You'll still need to reassemble them, but it's a far cry from rewriting all from scratch.
Otherwise, it could be possible to recover large parts of text if you remember some key words or phrases. This may be quite a lengthy operation. You can sift the whole partition to strings via dd and send the output via ssh to another machine, so as not to risk overwriting the local disk's free space (if you have another partition available, by all means use it).
Similarly, if the system was not rebooted, you have root access, and the /proc/kcore pseudo-file is of reasonable size, you can extract raw text from it with strings and dump it to a file. Then grep will be your friend. Possibly, other ways of accessing memory are available to you.

score 1 · Answer 2 · edited Oct 16 '15 at 02:06

1

If you haven't saved anything yet, press the UNDO key "U".

You can also try and check the swap file. It should be named yourfilename.swp or .yourfilename.swp, in the same directory or /var/tmp. Be sure to use ls -la in case the name begins with ..

Make a copy and open it to check its contents.

edited Oct 16 '15 at 02:06

G-Man Says 'Reinstate Monica'

22,130
27
68
117

answered Oct 15 '15 at 17:51

Jesus A. Sanchez

674
4
6

1

Even if the file is saved inside of vi things can be undone using `U` – Ketan Maheshwari Oct 15 '15 at 17:54
That's right... The ideas got mixed up while I was writing. "If you haven't saved" was supposed to go with "check the swap file" :) – Jesus A. Sanchez Oct 15 '15 at 18:03
Thanks Jesus, but I really don't see a swap file. I suppose the system thinks that I really wanted to get rid of most of the file. I didn't. So this was just a slip of my hand (unfortunately). (swp) – Guest Oct 15 '15 at 19:13
Note that, since the name of the swap file begins with **`.`**, the user would need to use `ls -la` to see it. – G-Man Says 'Reinstate Monica' Oct 15 '15 at 20:01
As @G-Man says, use ls -la ** and you should be able to see it. In linux/unix the files starting with a dot ( . ) are considered hidden files. – Jesus A. Sanchez Oct 15 '15 at 20:51

score 0 · Answer 3 · answered Oct 17 '15 at 11:47

If the session in vi is still open, the command :e! will restore the file immediately to the last saved version (if you just opened it and edited, it will recover the same version that you saw when you opened the file). U (undo) will work even if you saved changes, but you have to undo every action until you reach your desired version (I don't remember right now if there is a limit of undo actions... or how many they are)

Accidentally Removed from File

3 Answers3