Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there any way to recover an overwritten linux file? I uncompresed a tar file which overwrote some of my files. I read somewhere you can umount your home directory.

share|improve this question

migrated from stackoverflow.com Nov 16 '10 at 6:53

This question came from our site for professional and enthusiast programmers.

    
If the file was overwritten in the same physical location, you'll need an electron microscope. However, if the newer version of the file was written in a temporary location, then renamed with the old name, there is a chance the old data is still there, but marked as deleted. Good luck. –  user3463 Nov 16 '10 at 7:20

2 Answers 2

First thing you always do: Boot a live CD/USB so that your partition is mounted read-only, to avoid those spaces on the drive being re-used. Once another file uses that platter space, the data is gone.

Because of how Linux ext3 file system works, it actually zeroes out inode data on delete, making recovery impossible. This is for delete however, and I don't know if the same could apply to overwriting existing files. Hope you're feeling lucky. See this guide on how to recover deleted files on ext3

Then dd the partition to a file, and with some manual hacking extract the files out from the image file with a hex editor or similar tool.

Of course, this will only work if you can find the data of the files you lost. Text files (like code) would be easier to find and extract, while binary formats (like images or music) might be a bit more tricky.

Sometimes extreme situations call for extreme measures, for the other times we keep backups :-)

share|improve this answer

With the technical details described by Randolph Potter, you can start trying to recover your lost data with the undelete option in testdisk. I would recommend booting into a live cd like knoppix and running testdisk from there. The more you use your system, the more likely that that portion of your disk will be overwritten with other data.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.