89

When moving files between filesystems, mv doesn't delete a file before it's finished copying it, and it processes files sequentially (I initially said it copies then deletes each file in turn, but that's not guaranteed — at least GNU mv copies then deletes each command-line argument in turn, and POSIX specifies this behaviour). So you should have at most one ...


89

Your directory is still there :) You have renamed it .... Because files whose names start with . are hidden, you cannot see the directory unless you display hidden files run ls -A and there it is! Revert the change: mv .... original_folder_name and do the move correctly mv original_folder_name ../..


77

The link someone provided in the comments is likely your best chance. Linux debugfs Hack: Undelete Files That write-up though looking a little intimidating is actually fairly straight forward to follow. In general the steps are as follows: Use debugfs to view a filesystems log $ debugfs -w /dev/mapper/wks01-root At the debugfs prompt debugfs: lsdel ...


68

The answer is "Probably yes, but it depends on the filesystem type, and timing." None of those three examples will overwrite the physical data blocks of old_file or existing_file, except by chance. mv new_file old_file. This will unlink old_file. If there are additional hard links to old_file, the blocks will remain unchanged in those remaining links. ...


66

Don't shut down your machine. Do you still have a running shell? Is it bash? If so, you're fine. (But don't do this again.) Run: sudo cp /proc/$$/exe /bin/bash Voila, all is well. Since someone in the comments doubts that this works: [vagrant@localhost ~]$ cat /etc/shells /bin/sh /bin/bash /sbin/nologin /bin/dash /bin/tcsh /bin/csh [vagrant@...


64

If a running program still has the deleted file open, you can recover the file through the open file descriptor in /proc/[pid]/fd/[num]. To determine if this is the case, you can attempt the following: $ lsof | grep "/path/to/file" If the above gives output of the form: progname 5383 user 22r REG 8,1 16791251 265368 /path/to/file take note ...


56

MySQL stores DB files in /var/lib/mysql by default, but you can override this in the configuration file, typically called /etc/my.cnf, although Debian calls it /etc/mysql/my.cnf.


50

Adding a slash at the end of the destination path /opt/alfresco/archived/2020-01-07 would have made the mv command error out, as the 2020-01-07 directory evidently does not exist. This would have saved your files. They would also have been saved if /opt/alfresco/archived/2020-01-07 had been an existing directory (regardless of whether the destination path ...


46

Forget about trying to reinvent rsync, and use rsync. sudo rsync -av /location/to/drive1/ /location/to/drive2/ Make sure you use a trailing slash on the source, otherwise it would copy to /location/to/drive2/drive1. Double-check that the command succeeded, then run rm -rf /location/to/drive1/. The command above will overwrite any preexisting file from ...


40

Looking at the usage guide on extundelete it seems as though you're limited to undeleting files to a few ways. Restoring all extundelete is designed to undelete files from an unmounted partition to a separate (mounted) partition. extundelete will restore any files it finds to a subdirectory of the current directory named “RECOVERED_FILES”. To run the ...


39

The correct form would have been mv folder_name ../.. You've moved your folder to a new folder named ....; to recover your files, run mv .... folder_name Like many other commands, mv is somewhat dangerous because mistakes can in some cases cause unrecoverable loss of data (except from backups): anything which ends up being interpreted as "move these ...


36

bash is a shell, probably your system shell, so now weird things happen, while parts of the shell are still in memory. Once you log out or reboot, you,ll be in deeper trouble. So the first thing should be to change your shell to something safe. See what shells you have installed cat /etc/shells Then change your shell to one of the other shells listed ...


32

With a bit of chances, sometimes I can recover deleted files with this script or next solution in the answer : #!/bin/bash if [[ ! $1 ]]; then echo -e "Usage:\n\n\t$0 'file name'" exit 1 fi f=$(ls 2>/dev/null -l /proc/*/fd/* | fgrep "$1 (deleted" | awk '{print $9}') if [[ $f ]]; then echo "fd $f found..." cp -v "$f" "$1" else echo &...


30

What worked for me was given by arch (only applies to text files): grep -a -C 200 -F 'Unique string in text file' /dev/sdXN where /dev/sdXN is the partition containing the lost file (check with mount if unsure). Takes a little while, but worked when I accidentally deleted some source code I hadn't commited yet!


29

MacOS is a Unix OS and rm means "good-bye". The GUI interface allows you to move a file to the trash (which you can then recover) but that's not what you did. If you have a backup (e.g. you have Time Machine running) then you are saved. Clarification Strictly speaking (as @ire_and_curses points out) a rm simply deletes the directory entry for the file ...


27

The most important difference is that it allows you to increase the flexibility for disk replacement. It is better detailed below along with a number of other recommendations. One should consider to use a partition instead of the entire disk. This should be under the general recommendations for setting up an array and may certainly spare you some ...


24

It sounds like you've got a decent grasp on what happened. Yes, because you hard-powered-off the system before your changes were committed to disk, they were there when you booted back up. The system caches all writes before flushing them out to disk. There are several options which control this behavior, all located at /proc/sys/vm/dirty_* [kernel doc]. ...


23

You can use RPM to see what RPM that file belongs to: $ rpm -qf /etc/redhat-release centos-release-7-0.1406.el7.centos.2.5.x86_64 You can then fix it using yum: $ yum reinstall centos-release Might not work If the RPM that was used to do this install is no longer available then the above will not work: $ yum reinstall centos-release-7-0.1406.el7.centos....


22

You have to check man passwd: If the encrypted password is set to an asterisk (*), the user will be unable to login using login(1), but may still login using rlogin(1), run existing processes and initiate new ones through rsh(1), cron(8), at(1), or mail filters, etc. Trying to lock an account by simply changing the ...


20

After getting Stephen Kitt's answer and discussing this command as a potential solution: sudo mv -i ~/my_data_on_60GB_partition/* /media/admin/my_data/ I decided to hold off on running it until I got my head around what was happening, this answer describes what I found out and ended up doing. I'm using Gnu mv which copies files to the target, then only ...


19

Typical usage scenario when undeleting all files includes need to restore all files deleted from /dev/sdX1 during approximately last hour: mount -o remount,ro /dev/sdX1 extundelete --restore-all --after $(date -d "-2 hours" +%s) /dev/sdX1 find RECOVERED_FILES/ If satisfied with recovered files: mount -o remount,rw /dev/sdX1


18

Unfortunately, I was unable to recover the file system and had to resort to lower-level data recovery techniques (nicely summarised in Ubuntu's Data Recovery wiki entry), of which Sleuth Kit proved most useful. Marking as answered for cleanliness' sake.


18

Usually when editors save files, they delete or truncate to 0, thus freeing allocated space, and then write, which allocates new space. This results in the filesystem putting the data in a completely different physical location. So your idea might not work. You can get the physical location of a file using filefrag or hdparm --fibmap, and then use dd to ...


17

Undeletion is becoming more and more of a myth esp. with modern hardware (SSD) where anything that is deleted is also zeroed out (TRIM) right away, so there is zero chance of getting anything back. Your best bet would be to make an image of whatever you have right now and then see if there is anything left to be found using whatever tools you wish. ...


16

People mention that opening the DVD with VLC (which displays the DVD menu) magically makes the data accessible to dd, but nobody has yet explained why that is and how VLC accomplishes this feat. I managed to replicate this behavior when trying to play a DVD in my computer from a Kodi device hooked up to my TV, by using SMB to share the root of the DVD drive ...


16

There may be several misunderstandings here, so the command does not do what you perhaps expect it to. sudo is superfluous since you don't need sudo to read from /dev/urandom. The > some-file part is a shell redirection and thus not covered by sudo at all. So your sudo is super ineffective. (Note: in this particular case, sudo might work as intended ...


15

If a file has been deleted but is still open, that means the file still exists in the filesystem (it has an inode) but has a hard link count of 0. Since there is no link to the file, you cannot open it by name. There is no facility to open a file by inode either. There is no way to discover the file through its filesystem, and especially no way to look for ...


15

You can try and use Untrunc to fix the file. Restore a damaged (truncated) mp4, m4v, mov, 3gp video. Provided you have a similar not broken video. you may need to compile it from source, but there is another option to use a Docker container and bind the folder with the file into the container and fix it that way. You can use the included Dockerfile to ...


14

I'm not sure why this works but opening the DVD first with VLC, just enough to view the menu, and then pausing lets dd work.


14

This is working excellently in Ubuntu 14.04: sudo -i mdadm --assemble --scan You will get: mdadm: /dev/md/1 has been started with 1 drive (out of 2) Then mount and see your files: cd /mnt && mkdir to-restore-md1 && mount /dev/md1 to-restore-md1 ls -la to-restore-md1


Only top voted, non community-wiki answers of a minimum length are eligible