I accidentally overwrote my .zshrc file after a misexecuted command, which contains several hundred lines of configs. However, I still have 5 terminals that had zsh open before this incident, and as a result, they are unaffected. However, any new shell I open loses the entire zsh config, and I have no backup for it.

I could simply continue using these 5 terminals, but I think there must be some form of way to extract the zshrc from memory, as ostensibly zsh loads the file into memory when run and stores it there until it's killed. I've tried this:

sudo dd if=/dev/mem bs=1M count=256|hexdump -C > ramfile

But all I've gotten is data unrelated to my zshrc.

Any solutions would be much appreciated.

  • Zsh loads the file when it starts, but it doesn't store it anywhere: once it's executed, there's no need for the file anymore. You may be able to find it with a file recovery tool, but it's really hard to find a text file, it's a needle in a haystack, if it hasn't been overwritten already anyway. Commented May 28, 2021 at 19:44
  • Should be a breeze to restore from one of your backups. TODO: Start making backups.
    – Kusalananda
    Commented May 28, 2021 at 22:26
  • Problem is that my backups all don't store hidden files (i.e. dotfiles). But yes, got to start backupping!
    – JS4137
    Commented May 29, 2021 at 0:28

4 Answers 4


I would have suggested using /proc/PID/fd/ directory, but zsh closes the file descriptor pointing to its configuration after parsing it. From that, my best guess is that your file in its original form is gone.

However, there are ways to dump zsh's current configuration, which may help you rebuild it. This other question's answer comes to mind:

All key bindings:

for m ($keymaps) bindkey -LM $m

All ZLE user widgets

zle -lL

All zstyles:

zstyle -L

Loaded modules:

zmodload -L

All variables:

typeset -p +H -m '*'

With the zsh/parameters module loaded, that will also include aliases, options, functions...

  • You just saved my night.
    – aremmell
    Commented Mar 27, 2023 at 10:53


A few other things I found when recovering my overwritten zsh:

Check if any copy of the zshrc still exists

This didn't happen in my case, but if by chance there is a version of the .zshrc somewhere (notably if your code editor of choice autosaves files to a specific location), there is a small possibility of it still existing somewhere. To find it, run this:

sudo find . -name ".zshrc"

Look in these specific locations:

  • For Vim/Vi users (depends on config - might include /var/tmp, ~/.vim/sessions or ~/.local/share/nvim/swap)
  • For Atom users - ~/.atom/recovery
  • For Emacs users - by default you may have a file called ~/.zshrc~ available
  • General - /tmp

Recovering manually-added paths

This script prints out all directories added to $PATH:

import subprocess
paths = subprocess.check_output("echo $PATH", shell=True, text=True)
list = paths.split(":")
for item in list:
    print("export PATH=" + item + ":$PATH")

Recover certain parameters

Use set to list all parameters, then grep through the ones you need, such as: the default editor (EDITOR) and pager (PAGER)


I had the same issue. Luckily, the ~/.zshrc.backup file had the previous contents of my .zshrc file. I copied its contents to restore. I suggest checking ~/.zshrc.backup if you haven't closed any tab with previous .zshrc running. (macOS)

  • This comment saved my day. It's just plain and simple. However, in my case, the backup file was named as .zshrc-e Commented Dec 14, 2023 at 13:40

I had the same issue, and I could remember an exact string in the file. I used the following to find the contents and recover it:

grep -i -a -B100 -A100 'text in the deleted file' /dev/sda1

References: https://unix.stackexchange.com/a/150423/503193

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .