2

So in a merry mood last night, I deleted an important shell script from my system. I mistook it for something else and figured it wasn't needed. I am trying to recover it.

I have tried 'scalpel' and 'foremost'. However, the problem that I am facing is that both do not provide me an option of specifying a '.sh' file type to recover. In both, we need to specify what type of files to recover (JPEG, GIF, DOC etc). If no file type is specified in scalpel, it doesn't work. And Foremost starts recovering every file type if nothing is specified, none of which is the '.sh' file type that I'm looking for.

My question is: How can I recover a specific '.sh' file type from a specific folder on my root partition (instead of having to scan the whole partition when I know where the file was deleted from)?

3

If you are running an ext3-4 filesystem, you can use extundelete.

As you probably do not have it installed, you should boot from a Linux CD and use that to download/install (in RAM) and do the recovery. Installing on your system, or any other activity on your system, might reuse the disc blocks that were freed by deleting the script. So it is best to keep that system shut down until you can boot it from an Linux CD (or USB).

If you are using btrfs on your root filesystem you might want to look at this btrfs-undelete shell script.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.