How to recover a removed file under Linux?

Question

By accident, I used rm on a file I didn't want to delete. Is there a way that I can get it back under Linux?

Answer 1

The following are generic steps to recover text files.

1. First use wall command to tell user that system is going down in a single user mode:

   # wall
   System is going down to .... please save your work.
   

   Press CTRL+D to send message.

2. Next use init 1 command to take system to a single user mode:

   # init 1
   

3. Using grep (traditional UNIX way) to recover files

   Use following grep syntax:

   grep -b 'search-text' /dev/partition > file.txt
   

   OR

   grep -a -B[size before] -A[size after] 'text' /dev/[your_partition] > file.txt
   

   Where,

   -i : Ignore case distinctions in both the PATTERN and the input files i.e. match both uppercase and lowercase character.
   -a : Process a binary file as if it were text
   -B Print number lines/size of leading context before matching lines.
   -A: Print number lines/size of trailing context after matching lines.
   

   To recover text file starting with "nixCraft" word on /dev/sda1 you can try following command:

   # grep -i -a -B10 -A100 'nixCraft' /dev/sda1 > file.txt
   

4. Next use vi to see file.txt.

   This method is ONLY useful if deleted file is text file. If you are using ext2 file system, try out recover command.

Found at http://www.cyberciti.biz/tips/linuxunix-recover-deleted-files.html

Answer 2

• If it's very-very important, take the disk from the computer and hire a company to do it for you.
• If it is only very important, mount the disk read-only, copy the whole partition to a file using dd and try to find the file within it (using grep, or an editor).

Edit: sometimes ddrescue works better than dd.

Answer 3

If your filesystem is ext3, use ext3grep.

Answer 4

Testdisk has an undelete option that should work with Linux.

There is a walkthrough for Linux. Note that it works for ext2, ext3, and ext4.

Answer 5

I did this a couple of years ago. My approach was to directly, no time to lose, unmount partition and then

dd if=/dev/hda1 of=backup_image.ext3

to have a backup file of the exact state of the partition. Then you can mount the partition again and continue with business as usual as you search for the the deleted file in your created image. The image will probably be VERY large since you need all the "empty" space, so it might be a practical problem to store it.

Then it was just to perform boring searches after text snippets I expected to be somewhere in the soup of partition content. E.g. to find .tex-files, I ran

grep --binary-files=text -1000 "subsection" < backup_image.ext3 > latexfiles

which printed a large context around the phrase "subsection" and saved the output to a file to be manually searched through. I printed such a large context since it took such a long time to search the image that I'd rather not do it more times than I had to.

Also the command strings was helpful in removing binary garbage from the output, but if I recall correctly it also stripped all newlines, which could be a problem.

To find binary files in the same way, one might have success in finding a characteristic header or something of a certain file, but I imagine it to be a rather big adventure.

---

Brief technical notes: there are technical difficulties with disk recovery and Ext3/4. It is a long thing to explain, but briefly (and inadequately): Ext3/4 removes the "markers" that tell the OS where files are located on disk when you delete them. The files aren't scrubbed, but no one knows where on the disk they start and end anymore, and sometimes they even are fragmented at several places. Some other file systems just set the files' statuses to "deleted", but keep the location data. Then undelete is not harder than to look at file pointers with this flag (they should still be available if not too much activity has occured), and then hope their content has not been overwritten.

What is best? Rhetorical, in my view. Frequent backup is the answer to all these problems. Important data without an automated backup system is an accident waiting to happen, IMHO.

---

Obligatory personal anecdote: I was going to remove foo\ foo* from ~. I wrote

rm -r foo<Tab>*

, which sadly, since foo apparently was a symlink and the only file matching this, the shell made into

rm -r foo\ foo *

I pressed Enter and sat there looking at the command, which should have taken a second at most. After a bit longer time rm asked me if I wanted "to remove the write-protected file 'something'".Quite quickly I felt the chills and softly and very controlled I pressed Ctrl+c. ~Half of my ~ was deleted, but I managed to get everything of value back through above described grepping and some more or less current backups. I had some personally very valuable (read: time consuming) and very recent measurement data on disk that was lost, but I had made quadruple backups. One disappared here, another due to system outage at school, another was corrupt, and at first I couldn't find the fourth, since I by mistake had put it in the wrong folder :-D . Had not rm -r got stuck on a write-protected file, the fourth would have been eaten since that folder was mounted via sshfs in my ~. I'm a lot more careful about that kind of stuff since.

Answer 6

• The only correct answer is : restore your file from backup. Everybody must have a backup. For really important files, you should have two backups. You don't? Well, too bad, here's a lesson learnt ( Sorry to sound harsh, but I'm in data storage, and people don't back up until they lost some important data, that's a given fact. So yes, you look stupid, but so is nearly everybody else ).

• OK, you have no backup. you must stop using the filesystem which contained the file RIGHT NOW. Any write activity may definitely hose the file data that may (only may) remain on disk.

• if you made the tragic error to use only one partition as both the root filesystem and /home, that means you must boot from some other device. NOW .

• If your file is of some common format ( Word file, JPG, etc), use Photorec. Photorec can retrieve most common file formats.

• You can try the "ext3 undelete" method proposed previously, but you need to be comfortable with the command line, understand basic linux inner workings, etc.

• If your file is of some special format, tough luck. I once wrote a Perl program to scan a drive for some special files, and it worked pretty well; but you'll need to know some programming to do that, and be quite at ease with linux too.

Answer 7

If it's the standard rm, I hope you have a backup. The procedure to recover a deleted file would be different for each file system, if it can be done at all. Linux doesn't have a built-in "recycle bin"; once you delete a file, it's all but gone.

Any way you do it, you'll want to unplug the computer -- as soon as possible, as continuing to run the computer (even to shut it down) causes writes to the disk and increases the chance that some blocks formerly occupied by the file will be overwritten. Once you've done that, either put it in another computer, reboot off a live CD (making sure not to mount the drive unless you mount it read-only), or remove the hard drive and take it to a data recovery specialist.

Answer 8

Set your expectations low. If anything was written over the 'deleted' data, you will lose it.

I have done a small amount of recovery and the best tools I found were often designed towards certain formats. For example 'photorec' was great when I wanted to get tens of thousands of jpegs recovered.

Recuva has also helped me before now and might be your best choice. (Its free, don't get tricked into paying by their ads)

At the end of the day, if what you lost is important, take the drive offline and stop writing to it. Use every piece of recovery software you can find until you get your data back or it stops being worth it. If its really important, send it to professionals at a high price.

If you've had luck with a tool before, try it again seen as you're familiar with it. At the end of the day, they shouldn't be writing to disk and so you can use software until you find one that works.

Answer 9

If you have an application open which is currently reading the file, such as VLC or LibreOffice, then this terrific L&U.SO answer helped me out of this mess. Here is an alternative method for doing the same.

The general idea is to find the link in /proc/PID/fd/DESCRIPTOR_NUMBER and copy it back to its original location. Use ps aux | grep APP_NAME to find the PID and then ls -la /proc/PID/fd/ to find the proper DESCRIPTOR_NUMBER.

Answer 10

The "correct" answer is to assume there isn't a method to reliably recover, and instead restore from backups or a cloned system or reinstall.

TestDisk is a great tool, and there are other ways of being able to salvage some data from the physical drive depending on file system and recency of deletion, but the time and pain involved can be just too great, so KEEP BACKUPS (and also test that they are valid and restorable)!

Answer 11

Here is a great document for you. You will find a load of practical tips there.

BTW, there are two groups of people:

1. those who do backups
2. those who will do backups

Congratulations, you just promoted yourself to group 2. ;-)

Answer 12

If it's not overwritten by other users, then you are lucky. I accidentally deleted my cpp source file and used a tool called foremost, which helped me restored 60G cpp debris from the disk. Finally, I recovered my file by assembling those debris piece by piece. I think it scans certain pattern for specific file type and traverses all the inodes on the disk to recover files! Just have a try!

Answer 13

If accidentally you have deleted the file from Linux then you can use this command:

find /root -name "search text" -type f  -exec mv {} "/home" \;

in place of search text you can put file name and can specify directory where you want to restore in place of /home.

Answer 14

You can try this script. Works nicely and meant to be used inplace of rm and im using it extensively now.

https://github.com/nateshmbhat/safe-rm

Features :

• meant to be used in place of rm
• handles all arguments that rm can take
• handles the file name collisions with the files already in trash
• handles some permission issues automatically
• if rm is called from any other script or indirectly then the system 'rm' command is used automatically
• shows the appropriate error messages like those which arise in rm

Answer 15

I had the same problem last week and I tried a lot of programs, like debugfs, photorec, ext3grep and extundelete. ext3grep was the best program to recover files. The sintax is very easy:

ext3grep image.img --restore-all

or:

ext3grep /dev/sda3 --restore-all --after date -d '2015-01-01 00:00:00' '+%s' --before `date -d ‘2015-01-02 00:00:00’ ‘+%s’

This video shows is a mini tutorial that can help you.