Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Recover deleted files on linux???

Posted on 2011-09-18
7
Medium Priority
?
533 Views
Last Modified: 2012-08-14
Hi i wonder if its possible to recover a delete file on linux. i have backup a configuration file , but i deleted it by mistake!!!!
0
Comment
Question by:cismoney
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 68

Expert Comment

by:woolmilkporc
ID: 36556621
Most filemanagers which are part of graphical desktops (like KDE, CDE or similar) do have waste bins from which you could recover deleted files, but Unix/Linux shells (command line) don't. No chance here!

Restore your backup, and take good care to always have such a backup of all important files on your system at hand in the future!

wmp
0
 

Author Comment

by:cismoney
ID: 36556632
i use kde. i did a backup of previous configuration of eth0 but i deleted it. i need to find it
0
 
LVL 68

Assisted Solution

by:woolmilkporc
woolmilkporc earned 400 total points
ID: 36556634
Of course it's true that Unix/Linux files are not instantly really deleted if you remove them.

There are descriptions of methods how to (possibly) recover them, but please be aware that these methods are neither simple nor reliable.

Here is such a thing (particularly meant for the ext23 filesystem):

http://carlo17.home.xs4all.nl/howto/undelete_ext3.html

There are also some third-party tools around. Google for "undelete linux files"!

wmp
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 68

Expert Comment

by:woolmilkporc
ID: 36556645
As for KDE: Did you remove the file using a regular shell (maybe in an xterm window), or did you use KDE's file manager (Konqueror/Dolphin)?

The latter use KDE's waste bin, the shell (as said) doesn't.

To recover a file from the trash/waste bin just open the bin, right click the respective file and choose "restore".

wmp
0
 
LVL 68

Expert Comment

by:woolmilkporc
ID: 36556649
Typo in #36556634. It's "ext3", not "ext23". Sorry!
0
 
LVL 25

Accepted Solution

by:
madunix earned 1600 total points
ID: 36556950
There is no reliable way to recover a deleted file from an ext2 file system. All the methods are just best effort. The best suggestion is to do regular BACKUP on the important files before it is deleted.


For ext3 filesystem, you can recover the delete file using following steps(e.g.):

1. Create a test file

[root@madunix home]# touch test.txt
[root@madunix home]# cat test.txt
this is a test file

2. Check the i-node of this test file

[root@madunix home]# ll -li test.txt
579917 -rw-r--r-- 1 root root 20 Feb  3 02:52 test.txt

So the i-node of the test file is, 579917

3. Check the block of the data of this file

[root@madunix home]# debugfs -w /dev/hda3
debugfs 1.39 (29-May-2006)
debugfs:  logdump -i <579917>

    (inode block for inode 579917):
    Inode: 579917   Type: regular        Mode:  0644   Flags: 0x0   Generation: 2914279254
    User:     0   Group:     0   Size: 20
    File ACL: 603590    Directory ACL: 0
    Links: 1   Blockcount: 16
    Fragment:  Address: 0    Number: 0    Size: 0
    ctime: 0x4b68746c -- Wed Feb  3 02:52:28 2010
    atime: 0x4b687485 -- Wed Feb  3 02:52:53 2010
    mtime: 0x4b68746c -- Wed Feb  3 02:52:28 2010
    Blocks:  (0+1): 619053

Check the following line,

    Blocks:  (0+1): 619053

So the block of the data of this test file is 619053.

4. Delete this test file

[root@madunix home]# rm test.txt
rm: remove regular file `test.txt'? y

5. Recover this deleted test file

[root@madunix home]# dd if=/dev/hda3 of=/tmp/test.txt bs=4096 count=1 skip=619053
1+0 records in
1+0 records out
4096 bytes (4.1 kB) copied, 0.0010089 seconds, 4.1 MB/s

6. Check the content of the test file

[root@madunix home]# cat /tmp/test.txt
this is a test file


You could also try PhotoRec to recover your files: http://www.cgsecurity.org/wiki/PhotoRec
and check out the following
http://www.linux-magazine.com/w3/issue/71/Ask_Klaus!.pdf
http://www.linux-magazine.com/w3/issue/93/Foremost_Web.pdf
http://www.linuxjournal.com/content/how-recover-deleted-files
http://www.recoverdatatools.com/recover-deleted-files.html
http://www.linuxjournal.com/magazine/hack-and-when-disaster-strikes-attack-rm-command
http://www.ehow.com/how_2064953_recover-deleted-files-linux.html
0
 
LVL 13

Expert Comment

by:Hugh McCurdy
ID: 36557212
Adding a suggestion (not a solution).  As soon as the data is accidentally removed, the computer should be turned off.  The HD should be moved to another computer before attempting recovery.  Ideally the HD should be mirrored before attempting recovery.

In addition to luck, success will also hinge on the nature of the data.  Binary data is hard to recognize as being what you want.  Text files are easier.  For instance, if you removed a bunch of program source code, it's probably worth the effort.

I did this, once, long ago, and actually got everything back.

0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
In part one, we reviewed the prerequisites required for installing SQL Server vNext. In this part we will explore how to install Microsoft's SQL Server on Ubuntu 16.04.
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question