Retrieve deleted files on Linux VM guest

Question

I use Ubuntu on VMware to learn how to use Linux. I used rm on some folders and mistakenly deleted some files from /etc. I have some very important files on it. Is there a way to retrieve that files, for example using Knoppix? If yes, how I can do it?

Answer 1

Option 1:

Download any Live CD ISO image, Knoppix, Ubuntu, Arch, whatever. Knoppix is probably an easy option.

Then edit the VM settings to "insert" the virtual CD into the virtual CD drive, and start the VM. It should boot from the CD. If it does not, look at the VM settings again to figure out why.

Once the LiveCD has booted you should be able to mount the existing VM disks (or they might have been mounted automatically), and browse all the files in the system, you can then transfer them to a USB drive, or network drive.

Option 2:

Move the virtual disk files to one side for safe keeping, and reconfigure your VM to use a fresh blank hard disk. Reinstall your OS from clean.

Once the new OS is working, shut it down and re-add the old virtual disk as a second virtual disk. Boot the VM and you should be able to mount the old disk's partitions in the new OS (if they're not automatically mounted anyway).

Then you can copy the files you want across to the new disk. When you're done, the old disk can be removed from the config and deleted from the host system.

Finally

In both options, if your files were encrypted then you'll need to jump through a few more hoops, but as long as you didn't delete the encryption keys files it's doable, but that's a different topic.

Now backup your files. You should always assume that any of your machines, virtual or real, can go titsup at any moment, and that will be so much less stressful if you can just go get another, or reinstall from clean, and not lose anything. Dropbox/Google Drive/Ubuntu One/iCloud are your friends.

Answer 2

I am assuming you are using a standard install of ubuntu, so using the ext4 filesystem. Barring manually going through the disk image and piecing together your files (which is beyond my knowledge) I think your only option would be to use an undeletion utility (like: http://extundelete.sourceforge.net/ )

Up until I just googled it I actually thought it was not possible to easily restore files on ext3/4, and I have never used the above utility.

To use it, you will have to download a live linux distro (eg. knoppix) and boot your virtual machine with that disk image mounted in the virtual CD drive. Definitely dont boot your VM in the normal way, or it will make data recovery even harder!