Solved

Recover deleted files on linux???

Posted on 2011-09-18
7
508 Views
Last Modified: 2012-08-14
Hi i wonder if its possible to recover a delete file on linux. i have backup a configuration file , but i deleted it by mistake!!!!
0
Comment
Question by:cismoney
7 Comments
 
LVL 68

Expert Comment

by:woolmilkporc
ID: 36556621
Most filemanagers which are part of graphical desktops (like KDE, CDE or similar) do have waste bins from which you could recover deleted files, but Unix/Linux shells (command line) don't. No chance here!

Restore your backup, and take good care to always have such a backup of all important files on your system at hand in the future!

wmp
0
 

Author Comment

by:cismoney
ID: 36556632
i use kde. i did a backup of previous configuration of eth0 but i deleted it. i need to find it
0
 
LVL 68

Assisted Solution

by:woolmilkporc
woolmilkporc earned 100 total points
ID: 36556634
Of course it's true that Unix/Linux files are not instantly really deleted if you remove them.

There are descriptions of methods how to (possibly) recover them, but please be aware that these methods are neither simple nor reliable.

Here is such a thing (particularly meant for the ext23 filesystem):

http://carlo17.home.xs4all.nl/howto/undelete_ext3.html

There are also some third-party tools around. Google for "undelete linux files"!

wmp
0
Master Your Team's Linux and Cloud Stack!

The average business loses $13.5M per year to ineffective training (per 1,000 employees). Keep ahead of the competition and combine in-person quality with online cost and flexibility by training with Linux Academy.

 
LVL 68

Expert Comment

by:woolmilkporc
ID: 36556645
As for KDE: Did you remove the file using a regular shell (maybe in an xterm window), or did you use KDE's file manager (Konqueror/Dolphin)?

The latter use KDE's waste bin, the shell (as said) doesn't.

To recover a file from the trash/waste bin just open the bin, right click the respective file and choose "restore".

wmp
0
 
LVL 68

Expert Comment

by:woolmilkporc
ID: 36556649
Typo in #36556634. It's "ext3", not "ext23". Sorry!
0
 
LVL 25

Accepted Solution

by:
madunix earned 400 total points
ID: 36556950
There is no reliable way to recover a deleted file from an ext2 file system. All the methods are just best effort. The best suggestion is to do regular BACKUP on the important files before it is deleted.


For ext3 filesystem, you can recover the delete file using following steps(e.g.):

1. Create a test file

[root@madunix home]# touch test.txt
[root@madunix home]# cat test.txt
this is a test file

2. Check the i-node of this test file

[root@madunix home]# ll -li test.txt
579917 -rw-r--r-- 1 root root 20 Feb  3 02:52 test.txt

So the i-node of the test file is, 579917

3. Check the block of the data of this file

[root@madunix home]# debugfs -w /dev/hda3
debugfs 1.39 (29-May-2006)
debugfs:  logdump -i <579917>

    (inode block for inode 579917):
    Inode: 579917   Type: regular        Mode:  0644   Flags: 0x0   Generation: 2914279254
    User:     0   Group:     0   Size: 20
    File ACL: 603590    Directory ACL: 0
    Links: 1   Blockcount: 16
    Fragment:  Address: 0    Number: 0    Size: 0
    ctime: 0x4b68746c -- Wed Feb  3 02:52:28 2010
    atime: 0x4b687485 -- Wed Feb  3 02:52:53 2010
    mtime: 0x4b68746c -- Wed Feb  3 02:52:28 2010
    Blocks:  (0+1): 619053

Check the following line,

    Blocks:  (0+1): 619053

So the block of the data of this test file is 619053.

4. Delete this test file

[root@madunix home]# rm test.txt
rm: remove regular file `test.txt'? y

5. Recover this deleted test file

[root@madunix home]# dd if=/dev/hda3 of=/tmp/test.txt bs=4096 count=1 skip=619053
1+0 records in
1+0 records out
4096 bytes (4.1 kB) copied, 0.0010089 seconds, 4.1 MB/s

6. Check the content of the test file

[root@madunix home]# cat /tmp/test.txt
this is a test file


You could also try PhotoRec to recover your files: http://www.cgsecurity.org/wiki/PhotoRec
and check out the following
http://www.linux-magazine.com/w3/issue/71/Ask_Klaus!.pdf
http://www.linux-magazine.com/w3/issue/93/Foremost_Web.pdf
http://www.linuxjournal.com/content/how-recover-deleted-files
http://www.recoverdatatools.com/recover-deleted-files.html
http://www.linuxjournal.com/magazine/hack-and-when-disaster-strikes-attack-rm-command
http://www.ehow.com/how_2064953_recover-deleted-files-linux.html
0
 
LVL 13

Expert Comment

by:Hugh McCurdy
ID: 36557212
Adding a suggestion (not a solution).  As soon as the data is accidentally removed, the computer should be turned off.  The HD should be moved to another computer before attempting recovery.  Ideally the HD should be mirrored before attempting recovery.

In addition to luck, success will also hinge on the nature of the data.  Binary data is hard to recognize as being what you want.  Text files are easier.  For instance, if you removed a bunch of program source code, it's probably worth the effort.

I did this, once, long ago, and actually got everything back.

0

Featured Post

Master Your Team's Linux and Cloud Stack

Come see why top tech companies like Mailchimp and Media Temple use Linux Academy to build their employee training programs.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
wifi not working on Raspberry Pi 3? 2 77
Rate limit for DNS queries 7 83
AWS EC2 HTTP & HTTPS 2 44
linux - yum package installation issue 2 53
Introduction We as admins face situation where we need to redirect websites to another. This may be required as a part of an upgrade keeping the old URL but website should be served from new URL. This document would brief you on different ways ca…
Every server (virtual or physical) needs a console: and the console can be provided through hardware directly connected, software for remote connections, local connections, through a KVM, etc. This document explains the different types of consol…
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
This video shows how to set up a shell script to accept a positional parameter when called, pass that to a SQL script, accept the output from the statement back and then manipulate it in the Shell.

808 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question