I found myself in the same situation - I did a "mv FILE1.c FILE2.c".
You required that "no special programs are installed on the linux machine", which is possible if you install those tools on other machines or using a livedisk.
Stop or limit writes to your disk
In this kind of situation is it best to limit any writes on the system at hand because you could really overwrite the data you want to keep.
So, first of all, I hope that you are not browsing the web from the computer where you have your data on!
In some cases the file might still be open in a process. If you think it is, do not stop your machine just yet. You might want to bring the process keeping the file open to sleep first before looking for the handle to your data. And in that case, you do not have to stop your machine as. At least one other reply points to the method. The file will often have a giberish name in the directory where it was located (look using
ls -lart - the most recent files appear last and the date may hint you which is the best guess).
Use a recovery system
Then, according to your priorities, do one of the following:
If you can plug the disk in another machine or boot from a another partition or USB key or Live CD:
Stop the machine, if it is acceptable for you (and your system), just power it off by unplugging the power plug, battery or pressing the on/off button for a long time.
A clean power down adds some risk of overwriting the file you need.
If you can't start up another system:
Limit your writes to the system. Kill programs that are likely to write to disk.
'photorec' installed with 'testdisk'
Most of the time I use "testdisk". I landed on this page as I check if there was another method I did not know about.
"testdisk" is a set of tools that I often install beforehand, and I had it installed in my Ubuntu 16.04 machine ("legacy" for a good reason).
You required that "no special programs are installed on the linux machine" - you can install "testdisk" on another machine and read your original disk from there. You can boot from a USB disk as well.
If you can't do that, you can install it on the system at hand. In that case I recommend to remove some old big files that you have hanging around, such a a big ZIP that you downloaded a while ago, or an iso. I do that because I suppose that the recent data tends to sit near the end of the disk, not the start.
You can then just install 'testdisk' using something like (example for debian):
apt-get install testdisk
Then launch "photorec" and let it restore files to a device (partition) different from the one that your data is located on. That can be a USB drive, a network drive and even a the /tmp directory in some cases (when it is mapped to RAM).
photorec /d PATH_TO_OTHER_DEVICE
After selecting the device to restore from, choose "[File Opt]" from the bottom menu. Then deselect all options and select only the file type that you are looking for. In my case it was a "C"-file, so I selected "text".
photorec still created
.c files it found.
Then start the
[Search] and look only in the
While the restore was running, I performed a command like:
grep minTemp recup*/*.c
In the path where the recovery directories were created by photorec. I kne that "minTemp" was present in my file, and I was looking for a c file.
I got 30 entries of diffent versions of the file, examining the bigger ones first.
photorec was still running, but there were now new matches on 'minTemp', so I stopped that process as I was confident I had the file I needed.
Depending on your expertise, there is also the option of subconstracting the job. There are quite a few companies specializing in data recovery - they do not install any tool on your disk. The minimum cost is something like $500 if the subcontractor can recover data.
To better cope with such a situation, prepare!:
- Learn how to recover data before it occurs, try to recover some data when you do not need to recover it.
- Install 'testdisk' on your systems before you need it (installing testdisk will not overwrite the data as it is installed already);
- Keep your data on a partition different from your system files - some even recommend a separate partition for the /tmp directory;
- Use snapshots. You can do that on the "device" level (zfs/btrfs), snapshot tools (rsnapshot) and even private clouds that may keep some older file versions. There are also NAS systems that have such a function integrated (you can find the previous versions in '.snapshot' directories;
- Use backup tools like ShadowProtect, Acronis, and others that allow you to do frequent incremental backups of your online disks.
- Prepare a USB Drive with recovery tools and appropriate live OS's. [I keep one on me].
mv) is akin to deleting
old_file, not overwriting it, so methods (if any exist) for recovering deleted files, as opposed to overwritten files, would apply in that case. Your other two examples do indeed overwrite an existing