If someone were to delete commands from the shells history, is there any way to recover those deleted commands in Linux?

  • Hello vijay. What type of shell are you using? – Minix Jun 11 '15 at 21:18

With $disk being the disk or partition that contained the history file, and $cmd being a very distinct part of a command that you remember being in said history, and 100 being the number of commands that were in your history in total, then maybe

strings -w "$disk" | grep -C 100 "$cmd"

would find some fragments of it. The condition would be that the history file was deleted or truncated, but not overwritten in place or TRIM/discarded.

strings extracts all human-readable strings from a raw device. grep searches them and with the -C option also provides lines of context.

If you're looking for histories from other people, so you don't know any command after all... then maybe you could grep for ^cd \.\.$. It's a command that appears in most histories (at least, if the user is navigating directories at all). At the same time it's only rarely used in scripts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.