Rolling back a file

I'm sorry to say that if you didn't make any backups, you're almost certainly SOL here, especially from the command line.

Unlinking (deleting) a file can sometimes leave the data recoverable as long as nothing else grabs that particular inode; editing a file overwrites the data.

If your colleague still has the editor he was working in open and its undo buffer is long enough, that might be a way to recover the original, but beyond that I'm afraid you're sunk. Sorry.


Assuming you're using ext3, it might be possible to recover it if the replacement file was created as another inode (instead of overwriting the existing file), by using debugfs on the unmounted filesystem, and to find the inode of the original file. Unfortunately, if your colleage overwrite the file, rather than moving it aside and then deleting it, it's gone. I would suggest using debugfs with extreme caution, because you can seriously mess up a filesystem. It's use is only really for a last-ditch effort.