Solved

Recover deleted files on linux???

Posted on 2011-09-18
7
505 Views
Last Modified: 2012-08-14
Hi i wonder if its possible to recover a delete file on linux. i have backup a configuration file , but i deleted it by mistake!!!!
0
Comment
Question by:cismoney
7 Comments
 
LVL 68

Expert Comment

by:woolmilkporc
ID: 36556621
Most filemanagers which are part of graphical desktops (like KDE, CDE or similar) do have waste bins from which you could recover deleted files, but Unix/Linux shells (command line) don't. No chance here!

Restore your backup, and take good care to always have such a backup of all important files on your system at hand in the future!

wmp
0
 

Author Comment

by:cismoney
ID: 36556632
i use kde. i did a backup of previous configuration of eth0 but i deleted it. i need to find it
0
 
LVL 68

Assisted Solution

by:woolmilkporc
woolmilkporc earned 100 total points
ID: 36556634
Of course it's true that Unix/Linux files are not instantly really deleted if you remove them.

There are descriptions of methods how to (possibly) recover them, but please be aware that these methods are neither simple nor reliable.

Here is such a thing (particularly meant for the ext23 filesystem):

http://carlo17.home.xs4all.nl/howto/undelete_ext3.html

There are also some third-party tools around. Google for "undelete linux files"!

wmp
0
Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

 
LVL 68

Expert Comment

by:woolmilkporc
ID: 36556645
As for KDE: Did you remove the file using a regular shell (maybe in an xterm window), or did you use KDE's file manager (Konqueror/Dolphin)?

The latter use KDE's waste bin, the shell (as said) doesn't.

To recover a file from the trash/waste bin just open the bin, right click the respective file and choose "restore".

wmp
0
 
LVL 68

Expert Comment

by:woolmilkporc
ID: 36556649
Typo in #36556634. It's "ext3", not "ext23". Sorry!
0
 
LVL 25

Accepted Solution

by:
madunix earned 400 total points
ID: 36556950
There is no reliable way to recover a deleted file from an ext2 file system. All the methods are just best effort. The best suggestion is to do regular BACKUP on the important files before it is deleted.


For ext3 filesystem, you can recover the delete file using following steps(e.g.):

1. Create a test file

[root@madunix home]# touch test.txt
[root@madunix home]# cat test.txt
this is a test file

2. Check the i-node of this test file

[root@madunix home]# ll -li test.txt
579917 -rw-r--r-- 1 root root 20 Feb  3 02:52 test.txt

So the i-node of the test file is, 579917

3. Check the block of the data of this file

[root@madunix home]# debugfs -w /dev/hda3
debugfs 1.39 (29-May-2006)
debugfs:  logdump -i <579917>

    (inode block for inode 579917):
    Inode: 579917   Type: regular        Mode:  0644   Flags: 0x0   Generation: 2914279254
    User:     0   Group:     0   Size: 20
    File ACL: 603590    Directory ACL: 0
    Links: 1   Blockcount: 16
    Fragment:  Address: 0    Number: 0    Size: 0
    ctime: 0x4b68746c -- Wed Feb  3 02:52:28 2010
    atime: 0x4b687485 -- Wed Feb  3 02:52:53 2010
    mtime: 0x4b68746c -- Wed Feb  3 02:52:28 2010
    Blocks:  (0+1): 619053

Check the following line,

    Blocks:  (0+1): 619053

So the block of the data of this test file is 619053.

4. Delete this test file

[root@madunix home]# rm test.txt
rm: remove regular file `test.txt'? y

5. Recover this deleted test file

[root@madunix home]# dd if=/dev/hda3 of=/tmp/test.txt bs=4096 count=1 skip=619053
1+0 records in
1+0 records out
4096 bytes (4.1 kB) copied, 0.0010089 seconds, 4.1 MB/s

6. Check the content of the test file

[root@madunix home]# cat /tmp/test.txt
this is a test file


You could also try PhotoRec to recover your files: http://www.cgsecurity.org/wiki/PhotoRec
and check out the following
http://www.linux-magazine.com/w3/issue/71/Ask_Klaus!.pdf
http://www.linux-magazine.com/w3/issue/93/Foremost_Web.pdf
http://www.linuxjournal.com/content/how-recover-deleted-files
http://www.recoverdatatools.com/recover-deleted-files.html
http://www.linuxjournal.com/magazine/hack-and-when-disaster-strikes-attack-rm-command
http://www.ehow.com/how_2064953_recover-deleted-files-linux.html
0
 
LVL 13

Expert Comment

by:Hugh McCurdy
ID: 36557212
Adding a suggestion (not a solution).  As soon as the data is accidentally removed, the computer should be turned off.  The HD should be moved to another computer before attempting recovery.  Ideally the HD should be mirrored before attempting recovery.

In addition to luck, success will also hinge on the nature of the data.  Binary data is hard to recognize as being what you want.  Text files are easier.  For instance, if you removed a bunch of program source code, it's probably worth the effort.

I did this, once, long ago, and actually got everything back.

0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Backup & Restore 3 56
open source backup solution 1 29
android secure ftp 3 38
ignore other .htaccess 2 45
If you have a server on collocation with the super-fast CPU, that doesn't mean that you get it running at full power. Here is a preamble. When doing inventory of Linux servers, that I'm administering, I've found that some of them are running on l…
Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
This video shows how to set up a shell script to accept a positional parameter when called, pass that to a SQL script, accept the output from the statement back and then manipulate it in the Shell.
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

821 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question