Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use Ubuntu on VMware to learn how to use Linux. I used rm on some folders and mistakenly deleted some files from /etc. I have some very important files on it. Is there a way to retrieve that files, for example using Knoppix? If yes, how I can do it?

share|improve this question
Do you have a snapshot of the VM guest you can revert to? – uther May 17 '12 at 14:33
@uther no! I have no snapshot. – ethan May 17 '12 at 14:38
If possible, I would recommend powering the VM guest off and making a snapshot now to try and preserve the state of the filesystem before the deleted potentially gets overwritten. – uther May 17 '12 at 14:40

Option 1:

Download any Live CD ISO image, Knoppix, Ubuntu, Arch, whatever. Knoppix is probably an easy option.

Then edit the VM settings to "insert" the virtual CD into the virtual CD drive, and start the VM. It should boot from the CD. If it does not, look at the VM settings again to figure out why.

Once the LiveCD has booted you should be able to mount the existing VM disks (or they might have been mounted automatically), and browse all the files in the system, you can then transfer them to a USB drive, or network drive.

Option 2:

Move the virtual disk files to one side for safe keeping, and reconfigure your VM to use a fresh blank hard disk. Reinstall your OS from clean.

Once the new OS is working, shut it down and re-add the old virtual disk as a second virtual disk. Boot the VM and you should be able to mount the old disk's partitions in the new OS (if they're not automatically mounted anyway).

Then you can copy the files you want across to the new disk. When you're done, the old disk can be removed from the config and deleted from the host system.


In both options, if your files were encrypted then you'll need to jump through a few more hoops, but as long as you didn't delete the encryption keys files it's doable, but that's a different topic.

Now backup your files. You should always assume that any of your machines, virtual or real, can go titsup at any moment, and that will be so much less stressful if you can just go get another, or reinstall from clean, and not lose anything. Dropbox/Google Drive/Ubuntu One/iCloud are your friends.

share|improve this answer
I believe the OP is asking about recovering deleted files. The fact that they're on a VM is secondary (irrelevant, even). – Alexios May 17 '12 at 14:41
@Alexios the OP says he deleted some files from /etc, so I presumed he trashed his OS but the files are intact. – ams May 18 '12 at 8:02

I am assuming you are using a standard install of ubuntu, so using the ext4 filesystem. Barring manually going through the disk image and piecing together your files (which is beyond my knowledge) I think your only option would be to use an undeletion utility (like: http://extundelete.sourceforge.net/ )

Up until I just googled it I actually thought it was not possible to easily restore files on ext3/4, and I have never used the above utility.

To use it, you will have to download a live linux distro (eg. knoppix) and boot your virtual machine with that disk image mounted in the virtual CD drive. Definitely dont boot your VM in the normal way, or it will make data recovery even harder!

share|improve this answer
Bear in mind that undeleting files on ext4 filesystems is even more difficult and uncertain than undeleting on ext[23]. Sadly, the safest options may be off the table: (a) exercise care in handling files, and (b) have regular backups. – Alexios May 17 '12 at 14:40
@Alexios Yes, to my knowledge it was near impossible to recover ext4 files with an undelete tool, but I googled to make sure, and it turned up a tool, so I thought I should mention it. – Rqomey May 17 '12 at 14:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.