Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is there a command to recover/undelete deleted files by rm?

$ rm -rf /path/to/myfile

How can I recover myfile? If there is such a tool how can I use it?

share|improve this question

migrated from stackoverflow.com Jun 21 '13 at 14:26

This question came from our site for professional and enthusiast programmers.

1  
cyberciti.biz/tips/… can help. Also it is better in Stack Exchange. –  fedorqui Jun 21 '13 at 13:42
    
1. This would be better for Unix & Linux 2. Backups? –  Doorknob Jun 21 '13 at 13:42
    
+1 to @fedorqui for the site. –  unxnut Jun 21 '13 at 14:40
1  
Before you do anything, mount the filesystem read-only to make sure the data is not overwritten. Also, take a look at this post: superuser.com/questions/170857/ext4-undelete-utilities. –  paraxor Jun 21 '13 at 15:49

7 Answers 7

up vote 7 down vote accepted

The link someone provided in the comments is likely your best chance.

Linux debugfs Hack: Undelete Files

That write-up though looking a little intimidating is actually fairly straight forward to follow. In general the steps are as follows:

  1. Use debugfs to view a filesystems log

    $ debugfs -w /dev/mapper/wks01-root
    
  2. At the debugfs prompt

    debugfs: lsdel
    
  3. Sample output

    Inode  Owner  Mode    Size    Blocks   Time deleted
    23601299      0 120777      3    1/   1 Tue Mar 13 16:17:30 2012
    7536655      0 120777      3    1/   1 Tue May  1 06:21:22 2012
    2 deleted inodes found.
    
  4. Run the command in debugfs

    debugfs: logdump -i <7536655>
    
  5. Determine files inode

    ...
    ...
    ....
    output truncated
        Fast_link_dest: bin
        Blocks:  (0+1): 7235938
      FS block 7536642 logged at sequence 38402086, journal block 26711
        (inode block for inode 7536655):
        Inode: 7536655   Type: symlink        Mode:  0777   Flags: 0x0   Generation: 3532221116
        User:     0   Group:     0   Size: 3
        File ACL: 0    Directory ACL: 0
        Links: 0   Blockcount: 0
        Fragment:  Address: 0    Number: 0    Size: 0
        ctime: 0x4f9fc732 -- Tue May  1 06:21:22 2012
        atime: 0x4f9fc730 -- Tue May  1 06:21:20 2012
        mtime: 0x4f9fc72f -- Tue May  1 06:21:19 2012
        dtime: 0x4f9fc732 -- Tue May  1 06:21:22 2012
        Fast_link_dest: bin
        Blocks:  (0+1): 7235938
    No magic number at block 28053: end of journal.
    
  6. With the above inode info run the following commands

    # dd if=/dev/mapper/wks01-root of=recovered.file.001 bs=4096 count=1 skip=7235938
    # file recovered.file.001
    file: ASCII text, with very long lines
    

Files been recovered to recovered.file.001.

Other options

If the above isn't for you I've used tools such as photorec to recover files in the past, but it's geared for image files only. I've written about this method extensively on my blog in this article titled:

How to Recover Corrupt jpeg and mov Files from a Digital Camera's SDD Card on Fedora/CentOS/RHEL.

share|improve this answer
1  
I tried with debugfs -w /dev/sdb2 but lsdel sais: 0 deleted inodes found. –  rubo77 Sep 11 '13 at 7:54
    
It working, but sometimes. –  pylover Sep 17 '13 at 20:46

Most Linux recovery tools were command line based. If the user is specifically looking for some GUI based Linux tools for recover important files, consider reading the entire posts URLed below:

http://www.stellarinfo.com/support/kb/index.php/article/recover-deleted-files-from-linux

Thanks!!

share|improve this answer

When you delete a file, the link count in the inode table for that file is decreased by one. In Unix, when the link count drops down to 0, the data blocks for that file are marked as free and typically, references to those data blocks are lost. I just discovered from @fedorqui's comment that there may be some way to access those blocks but that is only applicable to ext3 filesystem.

One way to preserve the files will be to write a function that will allow you to move the files to a trash area (let us say $HOME/.trash) and recover the needed files from there. This function can be aliased to rm. You can schedule a cron job to delete the files that have been in the trash area for a certain number of days.

share|improve this answer

With a bit of chances, sometimes I can recover deleted files with this script :

#!/bin/bash

if [[ ! $1 ]]; then
    echo -e "Usage:\n\n\t$0 'file name'"
    exit 1
fi

f=$(ls 2>/dev/null -l /proc/*/fd/* | fgrep "$1 (deleted" | awk '{print $9}')

if [[ $f ]]; then
    echo "fd $f found..."
    cp -v "$f" "$1"
else
    echo >&2 "No fd found..."
    exit 2
fi

There's another usefull trick : If you know a pattern in your deleted files :

type alt+sys+resuo to reboot+remount in read-only, then with a live-cd, use grep to search in the hard-drive :

grep -a -C 500 'known pattern' /dev/sda | tee /tmp/recover

then edit /tmp/recover to keep only what's your file before.

share|improve this answer
1  
thanks, useful informations –  pylover Nov 3 '13 at 19:18
    
Added another solution, grep based. –  sputnick Nov 3 '13 at 19:24
1  
Added missing pattern in grep search. –  sputnick Nov 3 '13 at 19:40

This might save the trouble for some of you.
If you ever used gedit to edit that file, by default a copy of that file will be created.
For example let's suppose we have accidentaly deleted 'myfile.txt'.
In the folder that used to contain the file you have just deleted use these commands and you'll recover the copy from there:
ls | grep 'myfile.txt~'
With a bit of luck you'll find it and then:
cp 'myfile.txt~' 'myfile.txt'
I have recovered a file just now using this method. Best of luck!

share|improve this answer

I disagree that it is impossible, just very very difficult, and neither have I ever done it off Linux:

When files are deleted, they're not actually deleted. What happens is that the space that they were on the hard-drive is sort of reset, so that if the computer tries to write data there, nothing complains. Generally, the data on your hard drive you thought you deleted can be there almost a year later. Or at least, this is my experience on a Windows machine. Whether or not it works the same way from a commandline on Linux, I'm not sure, but you'd likely need a separate Live CD to open the partition like that, and there's also no guarantee the files are still there. I've done this on windows xp several times using Zero Assumption Recovery. I'm sure there's a similar tool around if you look hard enough.

share|improve this answer

connect drive through external interface

  1. mount
  2. umount /dev/{sd*}
  3. extundelete --restore-all /dev/{sd*}
  4. results go to home folder on boot drive
  5. bonus points: write a GUI for this

See this link for more info: undelete a just deleted file on ext4 with extundelete.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.