Solved

Recover deleted files on linux???

Posted on 2011-09-18
7
517 Views
Last Modified: 2012-08-14
Hi i wonder if its possible to recover a delete file on linux. i have backup a configuration file , but i deleted it by mistake!!!!
0
Comment
Question by:cismoney
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 68

Expert Comment

by:woolmilkporc
ID: 36556621
Most filemanagers which are part of graphical desktops (like KDE, CDE or similar) do have waste bins from which you could recover deleted files, but Unix/Linux shells (command line) don't. No chance here!

Restore your backup, and take good care to always have such a backup of all important files on your system at hand in the future!

wmp
0
 

Author Comment

by:cismoney
ID: 36556632
i use kde. i did a backup of previous configuration of eth0 but i deleted it. i need to find it
0
 
LVL 68

Assisted Solution

by:woolmilkporc
woolmilkporc earned 100 total points
ID: 36556634
Of course it's true that Unix/Linux files are not instantly really deleted if you remove them.

There are descriptions of methods how to (possibly) recover them, but please be aware that these methods are neither simple nor reliable.

Here is such a thing (particularly meant for the ext23 filesystem):

http://carlo17.home.xs4all.nl/howto/undelete_ext3.html

There are also some third-party tools around. Google for "undelete linux files"!

wmp
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 68

Expert Comment

by:woolmilkporc
ID: 36556645
As for KDE: Did you remove the file using a regular shell (maybe in an xterm window), or did you use KDE's file manager (Konqueror/Dolphin)?

The latter use KDE's waste bin, the shell (as said) doesn't.

To recover a file from the trash/waste bin just open the bin, right click the respective file and choose "restore".

wmp
0
 
LVL 68

Expert Comment

by:woolmilkporc
ID: 36556649
Typo in #36556634. It's "ext3", not "ext23". Sorry!
0
 
LVL 25

Accepted Solution

by:
madunix earned 400 total points
ID: 36556950
There is no reliable way to recover a deleted file from an ext2 file system. All the methods are just best effort. The best suggestion is to do regular BACKUP on the important files before it is deleted.


For ext3 filesystem, you can recover the delete file using following steps(e.g.):

1. Create a test file

[root@madunix home]# touch test.txt
[root@madunix home]# cat test.txt
this is a test file

2. Check the i-node of this test file

[root@madunix home]# ll -li test.txt
579917 -rw-r--r-- 1 root root 20 Feb  3 02:52 test.txt

So the i-node of the test file is, 579917

3. Check the block of the data of this file

[root@madunix home]# debugfs -w /dev/hda3
debugfs 1.39 (29-May-2006)
debugfs:  logdump -i <579917>

    (inode block for inode 579917):
    Inode: 579917   Type: regular        Mode:  0644   Flags: 0x0   Generation: 2914279254
    User:     0   Group:     0   Size: 20
    File ACL: 603590    Directory ACL: 0
    Links: 1   Blockcount: 16
    Fragment:  Address: 0    Number: 0    Size: 0
    ctime: 0x4b68746c -- Wed Feb  3 02:52:28 2010
    atime: 0x4b687485 -- Wed Feb  3 02:52:53 2010
    mtime: 0x4b68746c -- Wed Feb  3 02:52:28 2010
    Blocks:  (0+1): 619053

Check the following line,

    Blocks:  (0+1): 619053

So the block of the data of this test file is 619053.

4. Delete this test file

[root@madunix home]# rm test.txt
rm: remove regular file `test.txt'? y

5. Recover this deleted test file

[root@madunix home]# dd if=/dev/hda3 of=/tmp/test.txt bs=4096 count=1 skip=619053
1+0 records in
1+0 records out
4096 bytes (4.1 kB) copied, 0.0010089 seconds, 4.1 MB/s

6. Check the content of the test file

[root@madunix home]# cat /tmp/test.txt
this is a test file


You could also try PhotoRec to recover your files: http://www.cgsecurity.org/wiki/PhotoRec
and check out the following
http://www.linux-magazine.com/w3/issue/71/Ask_Klaus!.pdf
http://www.linux-magazine.com/w3/issue/93/Foremost_Web.pdf
http://www.linuxjournal.com/content/how-recover-deleted-files
http://www.recoverdatatools.com/recover-deleted-files.html
http://www.linuxjournal.com/magazine/hack-and-when-disaster-strikes-attack-rm-command
http://www.ehow.com/how_2064953_recover-deleted-files-linux.html
0
 
LVL 13

Expert Comment

by:Hugh McCurdy
ID: 36557212
Adding a suggestion (not a solution).  As soon as the data is accidentally removed, the computer should be turned off.  The HD should be moved to another computer before attempting recovery.  Ideally the HD should be mirrored before attempting recovery.

In addition to luck, success will also hinge on the nature of the data.  Binary data is hard to recognize as being what you want.  Text files are easier.  For instance, if you removed a bunch of program source code, it's probably worth the effort.

I did this, once, long ago, and actually got everything back.

0

Featured Post

Announcing the Most Valuable Experts of 2016

MVEs are more concerned with the satisfaction of those they help than with the considerable points they can earn. They are the types of people you feel privileged to call colleagues. Join us in honoring this amazing group of Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Setting up Secure Ubuntu server on VMware 1.      Insert the Ubuntu Server distribution CD or attach the ISO of the CD which is in the “Datastore”. Note that it is important to install the x64 edition on servers, not the X86 editions. 2.      Power on th…
Linux users are sometimes dumbfounded by the severe lack of documentation on a topic. Sometimes, the documentation is copious, but other times, you end up with some obscure "it varies depending on your distribution" over and over when searching for …
In a previous video, we went over how to export a DynamoDB table into Amazon S3.  In this video, we show how to load the export from S3 into a DynamoDB table.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question