Recover deleted files on linux???

Hi i wonder if its possible to recover a delete file on linux. i have backup a configuration file , but i deleted it by mistake!!!!
Who is Participating?
Fadi SODAH (aka madunix)Connect With a Mentor Chief Information Security Officer, CISA, CISSP, CFR, ICATE, MCSE, CCNA, CCNP and CCIPCommented:
There is no reliable way to recover a deleted file from an ext2 file system. All the methods are just best effort. The best suggestion is to do regular BACKUP on the important files before it is deleted.

For ext3 filesystem, you can recover the delete file using following steps(e.g.):

1. Create a test file

[root@madunix home]# touch test.txt
[root@madunix home]# cat test.txt
this is a test file

2. Check the i-node of this test file

[root@madunix home]# ll -li test.txt
579917 -rw-r--r-- 1 root root 20 Feb  3 02:52 test.txt

So the i-node of the test file is, 579917

3. Check the block of the data of this file

[root@madunix home]# debugfs -w /dev/hda3
debugfs 1.39 (29-May-2006)
debugfs:  logdump -i <579917>

    (inode block for inode 579917):
    Inode: 579917   Type: regular        Mode:  0644   Flags: 0x0   Generation: 2914279254
    User:     0   Group:     0   Size: 20
    File ACL: 603590    Directory ACL: 0
    Links: 1   Blockcount: 16
    Fragment:  Address: 0    Number: 0    Size: 0
    ctime: 0x4b68746c -- Wed Feb  3 02:52:28 2010
    atime: 0x4b687485 -- Wed Feb  3 02:52:53 2010
    mtime: 0x4b68746c -- Wed Feb  3 02:52:28 2010
    Blocks:  (0+1): 619053

Check the following line,

    Blocks:  (0+1): 619053

So the block of the data of this test file is 619053.

4. Delete this test file

[root@madunix home]# rm test.txt
rm: remove regular file `test.txt'? y

5. Recover this deleted test file

[root@madunix home]# dd if=/dev/hda3 of=/tmp/test.txt bs=4096 count=1 skip=619053
1+0 records in
1+0 records out
4096 bytes (4.1 kB) copied, 0.0010089 seconds, 4.1 MB/s

6. Check the content of the test file

[root@madunix home]# cat /tmp/test.txt
this is a test file

You could also try PhotoRec to recover your files:
and check out the following!.pdf
Most filemanagers which are part of graphical desktops (like KDE, CDE or similar) do have waste bins from which you could recover deleted files, but Unix/Linux shells (command line) don't. No chance here!

Restore your backup, and take good care to always have such a backup of all important files on your system at hand in the future!

cismoneyAuthor Commented:
i use kde. i did a backup of previous configuration of eth0 but i deleted it. i need to find it
Build your data science skills into a career

Are you ready to take your data science career to the next step, or break into data science? With Springboard’s Data Science Career Track, you’ll master data science topics, have personalized career guidance, weekly calls with a data science expert, and a job guarantee.

woolmilkporcConnect With a Mentor Commented:
Of course it's true that Unix/Linux files are not instantly really deleted if you remove them.

There are descriptions of methods how to (possibly) recover them, but please be aware that these methods are neither simple nor reliable.

Here is such a thing (particularly meant for the ext23 filesystem):

There are also some third-party tools around. Google for "undelete linux files"!

As for KDE: Did you remove the file using a regular shell (maybe in an xterm window), or did you use KDE's file manager (Konqueror/Dolphin)?

The latter use KDE's waste bin, the shell (as said) doesn't.

To recover a file from the trash/waste bin just open the bin, right click the respective file and choose "restore".

Typo in #36556634. It's "ext3", not "ext23". Sorry!
Hugh McCurdyCommented:
Adding a suggestion (not a solution).  As soon as the data is accidentally removed, the computer should be turned off.  The HD should be moved to another computer before attempting recovery.  Ideally the HD should be mirrored before attempting recovery.

In addition to luck, success will also hinge on the nature of the data.  Binary data is hard to recognize as being what you want.  Text files are easier.  For instance, if you removed a bunch of program source code, it's probably worth the effort.

I did this, once, long ago, and actually got everything back.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.