Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I did this on the command line (Ubuntu 12.04 , ext4)

mv some_arbit_file required_file

Is there any way I can recover required_file? I had put so much work into this. I usually backup files but I forgot this time.

share|improve this question
    
I would not used the machine, and would find a good piece of software (don't know one for linux) that can recover deleted files. Your data will most probably still be there. –  soandos Jul 8 '12 at 9:00
add comment

3 Answers

Some people suggest

$ su
# umount /home
# grep -a -A800 -B800 'soldier' /dev/sda2 | strings > recovered_file

Where your file was in the /home filesystem, 'home was mounted on /dev//sda2 and soldier is a key phrase that is likely to be unique to the overwritten file.

recovered_file is likely to be large but has a chance of containing text from the overwritten file. If the overwritten file was not primarily text, this approach isn't useful.

It is important to take measures to prevent the operating system making further writes to the filesystem that contains your file. A good way is to boot from a live-CD. If you can unmount the filesystem or remount it read-only, that is alkso good.


You may find it interesting to read http://carlo17.home.xs4all.nl/howto/undelete_ext3.html - though that applies more to deleted files than to overwritten ones. However if you previously edited your overwritten file, it is likeley that the editor left several deleted copies on disk as a natural part of the editing process.

share|improve this answer
add comment

Stop using/dismount the corresponding partition asap.

Consider this thread where extundelete is mentioned. Also, there exist photorec, foremost, and scalpel which are very powerful file carvers that may help recovering your file (e.g. by finding older versions or backups of your file that have not been overwritten yet).

All of these tools are available in your Ubuntu apt repositories (photorec comes with the testdisk package).

Remember to save the recovery results on another partition than the one where you recover your data from.

However, if your file has indeed been overwritten (i.e. the same area of the hard disk where the old file was stored has been used to store the new file) then there is no possibility to recover the file (Note: This is only valid for hard disks - ssds store (and "overwrite") files in another way). If you are lucky then you may only be able to recover parts of the file that were not overwritten, e.g. if the new file was smaller than the old one.

share|improve this answer
    
Note that it is possible to recover overwritten data on conventional HDD's but it cannot be done from home, it requires professional data recovery assistance (which usually costs big bucks). Success depends on how many times you overwrote it (once or twice is usually fine). –  Thomas Jul 8 '12 at 9:44
    
@Thomas: your information is out of date, no-one has ever published an account of actual recovery of the prior contents of overwritten sectors. It is now generally accepted that this is infeasible for modern hard disks. See anti-forensics.com/disk-wiping-one-pass-is-enough and infosecisland.com/blogview/… –  RedGrittyBrick Jul 8 '12 at 9:49
    
@Thomas Consider this article which gives a short summary why a single overwrite is enough to securely wipe your data on hard disks. –  speakr Jul 8 '12 at 10:14
add comment

I do not think the required_file was actually overwritten by this action. It was rather "unlinked" from the corresponding inode in order to "disappear". Neither did some_arbit_file change it's location -- it was rather the "pointer" wich previously pointed to required_file which now is pointing here.

There are tools around to help you in souch cases, like e.g. Sleuthkit or Testdisk. But they require some manual work -- and it's not that easy to do if you do not know where to start. There's also a script called ext3undel which uses those tools and automates the process, or the stand-alone extundelete utility.

Whatever you try to do: not touching the affected disk partition at all improves your chances of recovering the lost file. Do all actions on another machine would be best, and mount the affected drive read-only even for recovery also betters your chances. Not having a different machine, you could try a live CD (make sure not to mount the affected disk in write mode here as well!). Even being LiveCDs, they allow installing software in memory, so you can retrieve and run any of the above mentioned tools. Have an additional medium at hand (e.g. a memory stick, SD-Card, external drive...) to store your recovered files to, and run the process -- whichever you chose -- from there.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.