Is there any way to recover an overwritten linux file? I uncompresed a tar file which overwrote some of my files. I read somewhere you can umount your home directory.
migrated from stackoverflow.com Nov 16 '10 at 6:53
First thing you always do: Boot a live CD/USB so that your partition is mounted read-only, to avoid those spaces on the drive being re-used. Once another file uses that platter space, the data is gone.
Because of how Linux ext3 file system works, it actually zeroes out inode data on delete, making recovery impossible. This is for delete however, and I don't know if the same could apply to overwriting existing files. Hope you're feeling lucky. See this guide on how to recover deleted files on ext3
Then dd the partition to a file, and with some manual hacking extract the files out from the image file with a hex editor or similar tool.
Of course, this will only work if you can find the data of the files you lost. Text files (like code) would be easier to find and extract, while binary formats (like images or music) might be a bit more tricky.
Sometimes extreme situations call for extreme measures, for the other times we keep backups :-)
With the technical details described by Randolph Potter, you can start trying to recover your lost data with the undelete option in testdisk. I would recommend booting into a live cd like knoppix and running testdisk from there. The more you use your system, the more likely that that portion of your disk will be overwritten with other data.