Recover Deleted File in Linux

I still clearly remembered once I confused <mv> with <rm> and I deleted my assignment which cost me a whole weekend. That time, I wanted to execute the command: mv xxx.c src/xxx.c (I wanted to put all source code in src folder) but what I really typed in the terminal was: rm xxx.c src/xxx.c. Right after I pressed the enter key, I suddenly realized that was a disaster. But it was already too late (though src/xxx.c doesn’t exist, xxx.c will be deleted anyway if that command executes). Fortunately, I recovered it finally but it took much more work than recovering a file in Microsoft Windows.

When you notice you mistakenly delete a file, the first step to take is always DISABLING WRITE to that disk IMMEDIATELY. Delete command won’t erase your data from your disk but WRITE COMMAND WILL. Here, I use my system as example. I use ArchLinux as OS and ext4 as file system. All my personal data is stored under /home/jeffery and I mount /dev/sdb4 on /home. But home directory for my root user is /root. So I first use root user to make the disk read only. (For next few steps, I use user root. Since home directories of other users are in /home and it’s read-only now)

 

Then, I use a tool called undelete to help me.

 

The next step is using undelete to recover the file. Now, assume we mistakenly delete file a.temp in /home/jeffery/test/.

First we need to have the id of the parent folder. Then, we should unmount that disk and restore the file.

The result for extundelete /dev/sdb4 –inode 2892570 is in the following figure.

Screenshot from 2015-05-10 15:25:16

Finally, we can find the restored file in /RECOVERED_FILES. File name for the restored file is file.2892625. It’s the file exactly which I deleted just now.

The tool undelete can also help restore the whole directory you delete or simply recover everything.

One thought on “Recover Deleted File in Linux”

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code class="" title="" data-url=""> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong> <pre class="" title="" data-url=""> <span class="" title="" data-url="">