Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a command to recover/undelete deleted files by rm?

$ rm -rf /path/to/myfile

How can I recover myfile? If there is such a tool how can I use it?

share|improve this question

migrated from stackoverflow.com Jun 21 '13 at 14:26

This question came from our site for professional and enthusiast programmers.

cyberciti.biz/tips/… can help. Also it is better in Stack Exchange. – fedorqui Jun 21 '13 at 13:42
1. This would be better for Unix & Linux 2. Backups? – Doorknob Jun 21 '13 at 13:42
+1 to @fedorqui for the site. – unxnut Jun 21 '13 at 14:40
Before you do anything, mount the filesystem read-only to make sure the data is not overwritten. Also, take a look at this post: superuser.com/questions/170857/ext4-undelete-utilities. – Evan Teitelman Jun 21 '13 at 15:49
@EvanTeitelman you mean remount read-only is better than try to recover the file while it is umounted? btw, midnightcommander (mc) way, suggests umounting datarecoverypros.com/recover-linux-midnightcommander.html – Aquarius Power Aug 16 '15 at 3:34
up vote 33 down vote accepted

The link someone provided in the comments is likely your best chance.

Linux debugfs Hack: Undelete Files

That write-up though looking a little intimidating is actually fairly straight forward to follow. In general the steps are as follows:

  1. Use debugfs to view a filesystems log

    $ debugfs -w /dev/mapper/wks01-root
  2. At the debugfs prompt

    debugfs: lsdel
  3. Sample output

    Inode  Owner  Mode    Size    Blocks   Time deleted
    23601299      0 120777      3    1/   1 Tue Mar 13 16:17:30 2012
    7536655      0 120777      3    1/   1 Tue May  1 06:21:22 2012
    2 deleted inodes found.
  4. Run the command in debugfs

    debugfs: logdump -i <7536655>
  5. Determine files inode

    output truncated
        Fast_link_dest: bin
        Blocks:  (0+1): 7235938
      FS block 7536642 logged at sequence 38402086, journal block 26711
        (inode block for inode 7536655):
        Inode: 7536655   Type: symlink        Mode:  0777   Flags: 0x0   Generation: 3532221116
        User:     0   Group:     0   Size: 3
        File ACL: 0    Directory ACL: 0
        Links: 0   Blockcount: 0
        Fragment:  Address: 0    Number: 0    Size: 0
        ctime: 0x4f9fc732 -- Tue May  1 06:21:22 2012
        atime: 0x4f9fc730 -- Tue May  1 06:21:20 2012
        mtime: 0x4f9fc72f -- Tue May  1 06:21:19 2012
        dtime: 0x4f9fc732 -- Tue May  1 06:21:22 2012
        Fast_link_dest: bin
        Blocks:  (0+1): 7235938
    No magic number at block 28053: end of journal.
  6. With the above inode info run the following commands

    # dd if=/dev/mapper/wks01-root of=recovered.file.001 bs=4096 count=1 skip=7235938
    # file recovered.file.001
    file: ASCII text, with very long lines

Files been recovered to recovered.file.001.

Other options

If the above isn't for you I've used tools such as photorec to recover files in the past, but it's geared for image files only. I've written about this method extensively on my blog in this article titled:

How to Recover Corrupt jpeg and mov Files from a Digital Camera's SDD Card on Fedora/CentOS/RHEL.

share|improve this answer
I tried with debugfs -w /dev/sdb2 but lsdel sais: 0 deleted inodes found. – rubo77 Sep 11 '13 at 7:54
It working, but sometimes. – pylover Sep 17 '13 at 20:46
using extundelete is easier for ext3/4 and would probably lead to the same results. – eadmaster Jun 16 '15 at 19:54
this worked to recover a file, but I received ��@y��U���T6 �Ԝ��*e�0�� ��v'���T�0�<#selinuxsystem_u:object_r:rpm_var_lib_t:s0��}y��U���T6..... trying conv=ascii, conv=ibm, and conv=ebcdic yields same problem – codyc4321 Aug 4 '15 at 18:20
lsdel: Filesystem not open,how to resolve it? – Amitābha Oct 22 '15 at 9:38

With a bit of chances, sometimes I can recover deleted files with this script :


if [[ ! $1 ]]; then
    echo -e "Usage:\n\n\t$0 'file name'"
    exit 1

f=$(ls 2>/dev/null -l /proc/*/fd/* | fgrep "$1 (deleted" | awk '{print $9}')

if [[ $f ]]; then
    echo "fd $f found..."
    cp -v "$f" "$1"
    echo >&2 "No fd found..."
    exit 2

There's another usefull trick : If you know a pattern in your deleted files :

type alt+sys+resuo to reboot+remount in read-only, then with a live-cd, use grep to search in the hard-drive :

grep -a -C 500 'known pattern' /dev/sda | tee /tmp/recover

then edit /tmp/recover to keep only what's your file before.

share|improve this answer
thanks, useful informations – pylover Nov 3 '13 at 19:18
Added another solution, grep based. – Gilles Quenot Nov 3 '13 at 19:24
Added missing pattern in grep search. – Gilles Quenot Nov 3 '13 at 19:40
Your grep based solution is very clever and worked for me, even with the file system still mounted. Thanks! – wchargin Nov 27 '14 at 20:16

Most Linux recovery tools were command line based. If the user is specifically looking for some GUI based Linux tools for recover important files, consider reading the entire posts URLed below:



share|improve this answer

I had the same problem last week and I tried a lot of programs, like debugfs, photorec, ext3grep and extundelete. ext3grep was the best program to recover files. The syntax is very easy:

ext3grep image.img --restore-all


ext3grep /dev/sda3 --restore-all --after date -d '2015-01-01 00:00:00' '+%s' --before `date -d ‘2015-01-02 00:00:00’ ‘+%s’

This video is a mini tutorial that can help you.

share|improve this answer

An alternative may be using del instead of rm for deleting:


del has an undelete function and works with any file system.

Of course it is not a solution if you have already deleted your files with "take no prisoners" rm :-}

share|improve this answer
Not an answer as you have already said, but thanks for introducing the del command. – pylover Feb 12 at 8:26

When you delete a file, the link count in the inode table for that file is decreased by one. In Unix, when the link count drops down to 0, the data blocks for that file are marked as free and typically, references to those data blocks are lost. I just discovered from @fedorqui's comment that there may be some way to access those blocks but that is only applicable to ext3 filesystem.

One way to preserve the files will be to write a function that will allow you to move the files to a trash area (let us say $HOME/.trash) and recover the needed files from there. This function can be aliased to rm. You can schedule a cron job to delete the files that have been in the trash area for a certain number of days.

share|improve this answer

I disagree that it is impossible, just very very difficult, and neither have I ever done it off Linux:

When files are deleted, they're not actually deleted. What happens is that the space that they were on the hard-drive is sort of reset, so that if the computer tries to write data there, nothing complains. Generally, the data on your hard drive you thought you deleted can be there almost a year later. Or at least, this is my experience on a Windows machine. Whether or not it works the same way from a commandline on Linux, I'm not sure, but you'd likely need a separate Live CD to open the partition like that, and there's also no guarantee the files are still there. I've done this on windows xp several times using Zero Assumption Recovery. I'm sure there's a similar tool around if you look hard enough.

share|improve this answer

This might save the trouble for some of you.
If you ever used gedit to edit that file, by default a copy of that file will be created.
For example let's suppose we have accidentaly deleted 'myfile.txt'.
In the folder that used to contain the file you have just deleted use these commands and you'll recover the copy from there:
ls | grep 'myfile.txt~'
With a bit of luck you'll find it and then:
cp 'myfile.txt~' 'myfile.txt'
I have recovered a file just now using this method. Best of luck!

share|improve this answer

connect drive through external interface

  1. mount
  2. umount /dev/{sd*}
  3. extundelete --restore-all /dev/{sd*}
  4. results go to home folder on boot drive
  5. bonus points: write a GUI for this

See this link for more info: undelete a just deleted file on ext4 with extundelete.

share|improve this answer
Downvoters, please explain why you think extundelete is not good option? – lakshmipathi Apr 11 '15 at 6:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.