Restoring removed application

[mecho]

Is there a way to restore removed application in knoppix ? As far as I know removed apps are not really removed from the knoppix image file and I would like to know if there is a way to restore any removed application without using the persistent image

[kl522]

Yes there is a way to restore the removed application in knoppix ( when you are using persistent store ). The way UNIONFS works is like this :-

1. The knoppix image file is readonly.
2. The knoppix persistent store is read and write.
3. To give the user the "appearance" that files on the readonly image are deleted, it will write something to the persistent store to give an marking that the file in the readonly image is supposed to be "deleted".

Therefore in order for you to restore the deleted files, what you need to do is to remove the "marking" on the persistent store.

However, the issue here is that an application is consisting of many many files. For you to selective restore the deleted files is a very tedious piece of work. Unless you want to revert the entire image file to the original state, then you just delete everything on the persistent store.

Delete everything is easy. Selective deletion is tough.

[mecho]

Thanks kl522.

Just for the sake of know how. If I know all the application files, how do I remove the markings on the persistent image ?

[kl522]

The readonly files are in /KNOPPIX/......
The read/write persistent store files are in /KNOPPIX-DATA/......
The copy of files you normally deal with are in /UNIONFS/....

For example the simplest case if you delete a file /etc/a ( ie /UNIONFS/etc/a ),
if there is a /KNOPPIX/etc/a, then there will be a file /KNOPPIX-DATA/etc/.wh.a

So if you delete /KNOPPIX-DATA/etc/.wh.a, you will recover /etc/a.

Search the internet for more info along the line 'unionfs' and 'undelete'.

[mecho]

Thanks a lot kl522. That's what I wanted to know