4

I accidentally overwrote my .zshrc file after a misexecuted command, which contains several hundred lines of configs. However, I still have 5 terminals that had zsh open before this incident, and as a result, they are unaffected. However, any new shell I open loses the entire zsh config, and I have no backup for it.

I could simply continue using these 5 terminals, but I think there must be some form of way to extract the zshrc from memory, as ostensibly zsh loads the file into memory when run and stores it there until it's killed. I've tried this:

sudo dd if=/dev/mem bs=1M count=256|hexdump -C > ramfile

But all I've gotten is data unrelated to my zshrc.

Any solutions would be much appreciated.

Gilles 'SO- stop being evil'
  • 829,060
JS4137
  • 185
  • Zsh loads the file when it starts, but it doesn't store it anywhere: once it's executed, there's no need for the file anymore. You may be able to find it with a file recovery tool, but it's really hard to find a text file, it's a needle in a haystack, if it hasn't been overwritten already anyway. – Gilles 'SO- stop being evil' May 28 '21 at 19:44
  • Should be a breeze to restore from one of your backups. TODO: Start making backups. – Kusalananda May 28 '21 at 22:26
  • Problem is that my backups all don't store hidden files (i.e. dotfiles). But yes, got to start backupping! – JS4137 May 29 '21 at 00:28

4 Answers4

3

I would have suggested using /proc/PID/fd/ directory, but zsh closes the file descriptor pointing to its configuration after parsing it. From that, my best guess is that your file in its original form is gone.

However, there are ways to dump zsh's current configuration, which may help you rebuild it. This other question's answer comes to mind:

All key bindings:

for m ($keymaps) bindkey -LM $m

All ZLE user widgets

zle -lL

All zstyles:

zstyle -L

Loaded modules:

zmodload -L

All variables:

typeset -p +H -m '*'

With the zsh/parameters module loaded, that will also include aliases, options, functions...

Architector 4
  • 91
1

Self-Answer

A few other things I found when recovering my overwritten zsh:

Check if any copy of the zshrc still exists

This didn't happen in my case, but if by chance there is a version of the .zshrc somewhere (notably if your code editor of choice autosaves files to a specific location), there is a small possibility of it still existing somewhere. To find it, run this:

sudo find . -name ".zshrc"

Look in these specific locations:

  • For Vim/Vi users (depends on config - might include /var/tmp, ~/.vim/sessions or ~/.local/share/nvim/swap)
  • For Atom users - ~/.atom/recovery
  • For Emacs users - by default you may have a file called ~/.zshrc~ available
  • General - /tmp

Recovering manually-added paths

This script prints out all directories added to $PATH:

import subprocess
paths = subprocess.check_output("echo $PATH", shell=True, text=True)
list = paths.split(":")
for item in list:
    print("export PATH=" + item + ":$PATH")

Recover certain parameters

Use set to list all parameters, then grep through the ones you need, such as: the default editor (EDITOR) and pager (PAGER)

JS4137
  • 185
1

I had the same issue. Luckily, the ~/.zshrc.backup file had the previous contents of my .zshrc file. I copied its contents to restore. I suggest checking ~/.zshrc.backup if you haven't closed any tab with previous .zshrc running. (macOS)

alph
  • 11
1

I had the same issue, and I could remember an exact string in the file. I used the following to find the contents and recover it:

grep -i -a -B100 -A100 'text in the deleted file' /dev/sda1

References: https://unix.stackexchange.com/a/150423/503193

Albert
  • 141