0

Is there any way to recover an overwritten linux file? I uncompresed a tar file which overwrote some of my files. I read somewhere you can umount your home directory.

2
  • If the file was overwritten in the same physical location, you'll need an electron microscope. However, if the newer version of the file was written in a temporary location, then renamed with the old name, there is a chance the old data is still there, but marked as deleted. Good luck.
    – user3463
    Nov 16, 2010 at 7:20
  • @user3463 So is overwriting a file once good enough?
    – larry909
    Mar 1, 2019 at 1:18

2 Answers 2

2

First thing you always do: Boot a live CD/USB so that your partition is mounted read-only, to avoid those spaces on the drive being re-used. Once another file uses that platter space, the data is gone.

Because of how Linux ext3 file system works, it actually zeroes out inode data on delete, making recovery impossible. This is for delete however, and I don't know if the same could apply to overwriting existing files. Hope you're feeling lucky. See this guide on how to recover deleted files on ext3

Then dd the partition to a file, and with some manual hacking extract the files out from the image file with a hex editor or similar tool.

Of course, this will only work if you can find the data of the files you lost. Text files (like code) would be easier to find and extract, while binary formats (like images or music) might be a bit more tricky.

Sometimes extreme situations call for extreme measures, for the other times we keep backups :-)

1
  • well, it's not worth the effort at this point ^^ Oct 22, 2014 at 21:44
0

With the technical details described by Randolph Potter, you can start trying to recover your lost data with the undelete option in testdisk. I would recommend booting into a live cd like knoppix and running testdisk from there. The more you use your system, the more likely that that portion of your disk will be overwritten with other data.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .