Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

In Ubuntu, I move some file to a USB stick, using mv dir/file /media/7EXXX/swap/. When finishing this, I forget to "safely remove" before physically removing usb stick. Now, the file is not shown in usb. Is it possible to retrieve data not yet written to USB (which I assume resides on page/disk cache).

share|improve this question

1 Answer 1

up vote 2 down vote accepted

The simple answer is "No, sorry, but your data's gone" :(

Shutdown as soon as possible (maybe even uncleanly) and use a LiveCD, etc. to mount your source partition and recover the file with testdisk/photorec, etc.

Remember to append a ; sync next time so you know the file has been written to the USB when the prompt reappears.


In general it's almost impossible to retrieve data from the file cache unless you can somehow find what the "page cache" process is, and then there would be other issues.

You can examine and dump the contents of a process's memory from /proc/$pid/mem with a debugger such as gdb -- but the process must be able to be SIGSTOPped. So: the requirements to dump the file cache to a disk file for analysis and possible recovery with testdisk, photorec, etc. are something like:

  • Find the elusive "page cache" process
  • Make sure it's stoppable
  • Dump its memory to disk
  • All without rebooting

Someone who has significant experience with kernel development could probably put together some code to do this...

share|improve this answer
    
There is no page cache process. –  psusi Jun 4 '12 at 22:51
    
Hence elusive, and the quotes around that page cache ;) –  izx Jun 4 '12 at 22:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.