89

Your directory is still there :) You have renamed it .... Because files whose names start with . are hidden, you cannot see the directory unless you display hidden files run ls -A and there it is! Revert the change: mv .... original_folder_name and do the move correctly mv original_folder_name ../..


87

When moving files between filesystems, mv doesn't delete a file before it's finished copying it, and it processes files sequentially (I initially said it copies then deletes each file in turn, but that's not guaranteed — at least GNU mv copies then deletes each command-line argument in turn, and POSIX specifies this behaviour). So you should have at most one ...


66

The link someone provided in the comments is likely your best chance. Linux debugfs Hack: Undelete Files That write-up though looking a little intimidating is actually fairly straight forward to follow. In general the steps are as follows: Use debugfs to view a filesystems log $ debugfs -w /dev/mapper/wks01-root At the debugfs prompt debugfs: lsdel ...


65

Don't shut down your machine. Do you still have a running shell? Is it bash? If so, you're fine. (But don't do this again.) Run: sudo cp /proc/$$/exe /bin/bash Voila, all is well. Since someone in the comments doubts that this works: [vagrant@localhost ~]$ cat /etc/shells /bin/sh /bin/bash /sbin/nologin /bin/dash /bin/tcsh /bin/csh [vagrant@...


61

The answer is "Probably yes, but it depends on the filesystem type, and timing." None of those three examples will overwrite the physical data blocks of old_file or existing_file, except by chance. mv new_file old_file. This will unlink old_file. If there are additional hard links to old_file, the blocks will remain unchanged in those remaining links. ...


56

If a running program still has the deleted file open, you can recover the file through the open file descriptor in /proc/[pid]/fd/[num]. To determine if this is the case, you can attempt the following: $ lsof | grep "/path/to/file" If the above gives output of the form: progname 5383 user 22r REG 8,1 16791251 265368 /path/to/file take note ...


51

MySQL stores DB files in /var/lib/mysql by default, but you can override this in the configuration file, typically called /etc/my.cnf, although Debian calls it /etc/mysql/my.cnf.


46

Forget about trying to reinvent rsync, and use rsync. sudo rsync -av /location/to/drive1/ /location/to/drive2/ Make sure you use a trailing slash on the source, otherwise it would copy to /location/to/drive2/drive1. Double-check that the command succeeded, then run rm -rf /location/to/drive1/. The command above will overwrite any preexisting file from ...


39

The correct form would have been mv folder_name ../.. You've moved your folder to a new folder named ....; to recover your files, run mv .... folder_name Like many other commands, mv is somewhat dangerous because mistakes can in some cases cause unrecoverable loss of data (except from backups): anything which ends up being interpreted as "move these ...


36

Looking at the usage guide on extundelete it seems as though you're limited to undeleting files to a few ways. Restoring all extundelete is designed to undelete files from an unmounted partition to a separate (mounted) partition. extundelete will restore any files it finds to a subdirectory of the current directory named “RECOVERED_FILES”. To run the ...


33

bash is a shell, probably your system shell, so now weird things happen, while parts of the shell are still in memory. Once you log out or reboot, you,ll be in deeper trouble. So the first thing should be to change your shell to something safe. See what shells you have installed cat /etc/shells Then change your shell to one of the other shells listed ...


29

With a bit of chances, sometimes I can recover deleted files with this script or next solution in the answer : #!/bin/bash if [[ ! $1 ]]; then echo -e "Usage:\n\n\t$0 'file name'" exit 1 fi f=$(ls 2>/dev/null -l /proc/*/fd/* | fgrep "$1 (deleted" | awk '{print $9}') if [[ $f ]]; then echo "fd $f found..." cp -v "$f" "$1" else echo &...


28

MacOS is a Unix OS and rm means "good-bye". The GUI interface allows you to move a file to the trash (which you can then recover) but that's not what you did. If you have a backup (e.g. you have Time Machine running) then you are saved. Clarification Strictly speaking (as @ire_and_curses points out) a rm simply deletes the directory entry for the file ...


25

The most important difference is that it allows you to increase the flexibility for disk replacement. It is better detailed below along with a number of other recommendations. One should consider to use a partition instead of the entire disk. This should be under the general recommendations for setting up an array and may certainly spare you some ...


23

You can use RPM to see what RPM that file belongs to: $ rpm -qf /etc/redhat-release centos-release-7-0.1406.el7.centos.2.5.x86_64 You can then fix it using yum: $ yum reinstall centos-release Might not work If the RPM that was used to do this install is no longer available then the above will not work: $ yum reinstall centos-release-7-0.1406.el7.centos....


22

alias without parameter outputs the definitions of currently defined aliases. declare -f outputs the definitions of currently defined functions. export -p outputs the definitions of currently defined variables. All those commands output definitions ready to be reused, you can redirect their outputs directly to a new ~/.bashrc. All lists will contain a lot ...


22

It sounds like you've got a decent grasp on what happened. Yes, because you hard-powered-off the system before your changes were committed to disk, they were there when you booted back up. The system caches all writes before flushing them out to disk. There are several options which control this behavior, all located at /proc/sys/vm/dirty_* [kernel doc]. ...


22

You have to check man passwd: If the encrypted password is set to an asterisk (*), the user will be unable to login using login(1), but may still login using rlogin(1), run existing processes and initiate new ones through rsh(1), cron(8), at(1), or mail filters, etc. Trying to lock an account by simply changing the ...


21

What worked for me was given by arch (only applies to text files): grep -a -C 200 -F 'Unique string in text file' /dev/sdXN where /dev/sdXN is the partition containing the lost file (check with mount if unsure). Takes a little while, but worked when I accidentally deleted some source code I hadn't commited yet!


19

After getting Stephen Kitt's answer and discussing this command as a potential solution: sudo mv -i ~/my_data_on_60GB_partition/* /media/admin/my_data/ I decided to hold off on running it until I got my head around what was happening, this answer describes what I found out and ended up doing. I'm using Gnu mv which copies files to the target, then only ...


18

Usually when editors save files, they delete or truncate to 0, thus freeing allocated space, and then write, which allocates new space. This results in the filesystem putting the data in a completely different physical location. So your idea might not work. You can get the physical location of a file using filefrag or hdparm --fibmap, and then use dd to ...


17

Undeletion is becoming more and more of a myth esp. with modern hardware (SSD) where anything that is deleted is also zeroed out (TRIM) right away, so there is zero chance of getting anything back. Your best bet would be to make an image of whatever you have right now and then see if there is anything left to be found using whatever tools you wish. ...


17

Typical usage scenario when undeleting all files includes need to restore all files deleted from /dev/sdX1 during approximately last hour: mount -o remount,ro /dev/sdX1 extundelete --restore-all --after $(date -d "-2 hours" +%s) /dev/sdX1 find RECOVERED_FILES/ If satisfied with recovered files: mount -o remount,rw /dev/sdX1


16

I think that the simplest answer is that dd, dd_rescue and ddrescue are not designed to defeat copy protection schemes. They make no assumptions about the format of the data and try to maintain the integrity of the whole of the original on disk data. In the case of dd I suspect that it is terminating due to an intentional read error on the disk that is part ...


16

Unfortunately, I was unable to recover the file system and had to resort to lower-level data recovery techniques (nicely summarised in Ubuntu's Data Recovery wiki entry), of which Sleuth Kit proved most useful. Marking as answered for cleanliness' sake.


16

There may be several misunderstandings here, so the command does not do what you perhaps expect it to. sudo is superfluous since you don't need sudo to read from /dev/urandom. The > some-file part is a shell redirection and thus not covered by sudo at all. So your sudo is super ineffective. (Note: in this particular case, sudo might work as intended ...


14

If a file has been deleted but is still open, that means the file still exists in the filesystem (it has an inode) but has a hard link count of 0. Since there is no link to the file, you cannot open it by name. There is no facility to open a file by inode either. There is no way to discover the file through its filesystem, and especially no way to look for ...


13

There isn't a standard offset per-se, as of course you can start the partition wherever you want. But let's assume for a moment that you're looking for the first partition, and it was created more or less accepting defaults. There are then two places you may find it, assuming you were using a traditional DOS partition table: Starting at (512-byte) sector 63....


13

The accounts with passwords are the accounts with a glob of base64 gibberish in the second field: root:8sh9JBUR0VYeQ:0:0:Super-User,,,,,,,:/:/bin/ksh lp:VvHUV8idZH1uM:9:9:Print Spooler Owner:/var/spool/lp:/bin/sh This computer appears to be using the traditional, DES-based crypt(3) password hash. This hash is quite weak by modern standards; if you can't ...


13

It depends on what exactly was there before, but it might be easy(-ish) to recover from this. Use dd to create a full image of your USB drive on a safe location. Use dd to create a full image of your USB drive on a safe location. Yes, please do keep a full image. Data recovery operations can often cause more damage than one would expect. Try to remember ...


Only top voted, non community-wiki answers of a minimum length are eligible