195

Is there a command to recover/undelete deleted files by rm?

rm -rf /path/to/myfile

How can I recover myfile? If there is a tool to do this, how can I use it?

Improve this question
2

14 Answers 14

Reset to default
103

The link someone provided in the comments is likely your best chance.

Linux debugfs Hack: Undelete Files

That write-up though looking a little intimidating is actually fairly straight forward to follow. In general the steps are as follows:

  1. Use debugfs to view a filesystems log

     $ debugfs -w /dev/mapper/wks01-root

  2. At the debugfs prompt

     debugfs: lsdel

  3. Sample output

     Inode  Owner  Mode    Size    Blocks   Time deleted
 23601299      0 120777      3    1/   1 Tue Mar 13 16:17:30 2012
 7536655      0 120777      3    1/   1 Tue May  1 06:21:22 2012
 2 deleted inodes found.

  4. Run the command in debugfs

     debugfs: logdump -i <7536655>

  5. Determine files inode

     ...
 ...
 ....
 output truncated
     Fast_link_dest: bin
     Blocks:  (0+1): 7235938
   FS block 7536642 logged at sequence 38402086, journal block 26711
     (inode block for inode 7536655):
     Inode: 7536655   Type: symlink        Mode:  0777   Flags: 0x0   Generation: 3532221116
     User:     0   Group:     0   Size: 3
     File ACL: 0    Directory ACL: 0
     Links: 0   Blockcount: 0
     Fragment:  Address: 0    Number: 0    Size: 0
     ctime: 0x4f9fc732 -- Tue May  1 06:21:22 2012
     atime: 0x4f9fc730 -- Tue May  1 06:21:20 2012
     mtime: 0x4f9fc72f -- Tue May  1 06:21:19 2012
     dtime: 0x4f9fc732 -- Tue May  1 06:21:22 2012
     Fast_link_dest: bin
     Blocks:  (0+1): 7235938
 No magic number at block 28053: end of journal.

  6. With the above inode info run the following commands

     # dd if=/dev/mapper/wks01-root of=recovered.file.001 bs=4096 count=1 skip=7235938
 # file recovered.file.001
 file: ASCII text, with very long lines

Files been recovered to recovered.file.001.

Other options

If the above isn't for you I've used tools such as photorec to recover files in the past, but it's geared for image files only. I've written about this method extensively on my blog in this article titled:

How to Recover Corrupt jpeg and mov Files from a Digital Camera's SDD Card on Fedora/CentOS/RHEL.

Improve this answer
18
  • 30
    I tried with debugfs -w /dev/sdb2 but lsdel sais: 0 deleted inodes found.
    – rubo77
    Commented Sep 11, 2013 at 7:54
  • 8
    using extundelete is easier for ext3/4 and would probably lead to the same results.
    – eadmaster
    Commented Jun 16, 2015 at 19:54
  • 9
    lsdel: Filesystem not open,how to resolve it?
    – 王奕然
    Commented Oct 22, 2015 at 9:38
  • 8
    I get /dev/mapper/wks01-root: No such file or directory while opening filesystem Where did you get this /dev/mapper/wks01-root from?
    – Marko Avlijaš
    Commented May 2, 2017 at 12:04
  • 10
    This does NOT work on ext3 or ext4, so it’s unfortunately quite useless. The debugfs manual states that: "This command was useful for recovering from accidental file deletions for ext2 file systems. Unfortunately, it is not useful for this purpose if the files were deleted using ext3 or ext4, since the inode's data blocks are no longer available after the inode is released."
    – Arcturus B
    Commented Nov 19, 2021 at 9:59
71

If you know a very specific pattern in your deleted files, use grep to search in the hard-drive (maybe browse your clipboard to search a pasted line, or yank):

grep -a -C 300 -F 'known fixed string in deleted file' /dev/sda > ~/recover

then edit ~/recover to keep only what was your file before by editing. With by example editor, that will be a simple task.

Hey, if with Unix philosophy all is files, it's time to take advantage of this, no ?

Explanations

  • -a is meant to grep even binary data
  • -C<NUM> specifies lines of output context from before and after each match of the string; you can use -B<NUM> to include lines before each match or -A<NUM> to include lines after each match instead
  • -F fixed string

Another approach, using potential remaining File Descriptor

With a bit of chances, sometimes I can recover deleted files with this :

#!/bin/bash

export LANG=C

if [[ ! $1 || $1 == -h || $1 == --help ]]; then
    echo -e "Usage:\n\n\t$0 '[path/]<file name>'"
    exit 1
fi

files=(
    $(file 2>/dev/null /proc/*/fd/* |
        grep "(deleted)'$" | 
        sed -r 's@(:.*broken\s+symbolic\s+link\s+to\s+.|\(deleted\).$)@ @g' |
        grep "$1" |
        cut -d' ' -f1
    )
)

if [[ ${files[@]} ]]; then
    for f in ${files[@]}; do
        echo "fd $f match... Try to copy this fd to another place quickly!"
    done
else
    echo >&2 "No matching fd found..."
    exit 2
fi
Improve this answer
13
  • 13
    Your grep based solution is very clever and worked for me, even with the file system still mounted. Thanks!
    – wchargin
    Commented Nov 27, 2014 at 20:16
  • 2
    I don't understand how the grep solution worked for you, it outputs only binary data. How is that useful?
    – w00t
    Commented Aug 15, 2016 at 0:33
  • 3
    @w00t Sure, it "only" spits out binary data. But sometimes that binary data happens to contain the ASCII bits corresponding to the file I'm looking for. I guess I don't understand the question?
    – wchargin
    Commented Sep 5, 2016 at 2:17
  • 2
    @w00t the trick is to use a search pattern that is very specific to that file. The grep command will take the 500 lines before and after each matching line, so it will still spit out a lot of irrelevant data, but with a text editor that can cope with that (e.g. Vim), it's easy to sort out the good from the bad stuff. You could also filter out all lines with nonprintable characters by piping it through another grep command: grep -av "[^[:print:]]"
    – JimmyMcHoover
    Commented Mar 28, 2017 at 19:12
  • 2
    you saved my day dude
    – Clarance Liberiste Ntwari
    Commented Jun 20 at 23:26
55
+50

What worked for me was given by arch (only applies to text files):

grep -a -C 200 -F 'Unique string in text file' /dev/sdXN

where /dev/sdXN is the partition containing the lost file (check with mount if unsure).

Takes a little while, but worked when I accidentally deleted some source code I hadn't commited yet!

Improve this answer
8
  • 8
    Very useful for programmers!. usually, we always lost our own codes.
    – pylover
    Commented Jun 28, 2017 at 11:30
  • 3
    tell me about it, I accidentally ran rm data/*.json python myFile.py instead of rm data/*.json && python myFile.py
    – William Becker
    Commented Jun 30, 2017 at 9:03
  • 4
    Thanks mate, you just helped me recover a text file I spent 2 hours writing at night. P.S. /dev/sdXN is for the file system, right? I found mine with df -T | awk '{print $1,$2,$NF}' | grep "^/dev"
    – Alex
    Commented Apr 15, 2018 at 16:31
  • I see just the binary of the file. Is there a way to convert it to normal format?
    – silgon
    Commented Sep 21, 2018 at 7:25
  • grep: conflicting matchers specified
    – felwithe
    Commented Sep 25, 2019 at 12:49
28

Recovery Tools - Command Line:

Recovery Tools - GUI:

Info:

In my personal experience, I get my data back using ufs-explorer and photorec.

Sources: Linuxhacks.org
Disclosure: I am the owner of Linuxhacks.org

Improve this answer
3
  • 1
    R-Linux got me the deleted files back, thx!
    – lowtechsun
    Commented May 17, 2021 at 19:14
  • testdisk works well on exfat partition
    – rodvlopes
    Commented Feb 12, 2022 at 23:07
  • testdisk worked like a charm. My only problem was picking which of the many copies of the target files was the most recent. A little scary running a program like this, as root but desperate times..
    – Jeffrey Blattman
    Commented May 23, 2022 at 19:04
17

Although this Question is solved and a few years old, I want to mention the testdisk utility.

How to recover files with testdisk is explained well in this tutorial. To recover files run testdisk /dev/sdX and select your partition table type. After this, select [ Advanced ] Filesystem Utils, then choose your partition and select [Undelete]. Now you can browse and select deleted files and copy them to another location in your filesystem.

Improve this answer
2
  • This seems to only apply to FAT partitions, though, which are uncommon on *nix.
    – MrAureliusR
    Commented Sep 10, 2021 at 11:58
  • Yes, the tutorial applies to FAT filesystems. Testdisk itself should also work with filesystems which are more common on *nix, like Ext2 or Ext3. At least that's what the testdisk man page says. I didn't try it though. (@Aurelius Sorry for the late response btw.)
    – NoUmlautsAllowed
    Commented Oct 26, 2021 at 18:00
12

An alternative may be using del instead of rm for deleting:

http://fex.belwue.de/fstools/del.html

del has an undelete function and works with any file system.

Of course it is not a solution if you have already deleted your files with "take no prisoners" rm :-}

Improve this answer
2
  • 5
    Not an answer as you have already said, but thanks for introducing the del command.
    – pylover
    Commented Feb 12, 2016 at 8:26
  • 1
    I would also mention trash-cli by Andrea Francia ( github.com/andreafrancia/trash-cli ), perhaps a more "modern" tool. It integrates with the FreeDesktop.org Trash, it's a completely CLI tool and it can be found in most Linux distributions.
    – gianfrus
    Commented Oct 30, 2021 at 21:35
7

I had the same problem last week and I tried a lot of programs, like debugfs, photorec, ext3grep and extundelete. ext3grep was the best program to recover files. The syntax is very easy:

ext3grep image.img --restore-all

or:

ext3grep /dev/sda3 --restore-all --after `date -d '2015-01-01 00:00:00' '+%s'` --before `date -d '2015-01-02 00:00:00' '+%s'`

This video is a mini tutorial that can help you.

Improve this answer
1
  • Didn't work on my ext4 drive, and I don't think there's an ext4grep.
    – Sridhar Sarnobat
    Commented Aug 8, 2020 at 3:33
6

connect drive through external interface

  1. mount
  2. umount /dev/{sd*}
  3. extundelete --restore-all /dev/{sd*}
  4. results go to home folder on boot drive
  5. bonus points: write a GUI for this

See this link for more info: undelete a just deleted file on ext4 with extundelete.

Improve this answer
1
  • 3
    Nice! Thanks for posting. extundelete is a new tool for me. I used this today and found it extremely helpful. Much more helpful IMO than the accepted answer. The only things I would add to this answer to improve it slightly are (1) to reiterate the instructions in some other answers that one should power down the affected computer as soon as one realizes that the files were mistakenly deleted, and (2) to boot from a liveCD or liveUSB OS like Kali Linux which includes the extundelete utility (I found that many other liveCDs like Debian Jessie do not include this utility on their install media).
    – Kevin Ford The Submariner
    Commented Mar 13, 2017 at 16:22
6

Recover deleted files with ext4magic

sources to read: https://wiki.archlinux.org/title/File_recovery#TestDisk_and_PhotoRec

Ext4magic is another recovery tool for the ext3 and ext4 file system.

Be very careful:

  • you must be in a different location, not in the HDD you are trying to recover. The best way is to make a clone of the HDD you are trying to recover, so you can try with different methods.
  • You should not write anymore in the disc that you want to recover.
  • This method works only for ext3 and ext4 file-systems, so please check what file system you are using before starting.

Example without cloning the HDD:

Before beginning, check what file system you have with the above command:

$ df -Th
Filesystem     Type      Size  Used Avail Use% Mounted on
dev            devtmpfs  3,9G     0  3,9G   0% /dev
run            tmpfs     3,9G  1,8M  3,9G   1% /run
/dev/sda2      ext4      458G  151G  284G  35% /
tmpfs          tmpfs     3,9G  4,3M  3,9G   1% /dev/shm
tmpfs          tmpfs     3,9G   56M  3,8G   2% /tmp

After you determine that you are using ext3 or ext4, go on and plug an external HDD drive and open the terminal from the external HDD

To recover all files, deleted in the last 24 hours:

ext4magic /dev/sdXY -r

To recover a directory or file:

ext4magic /dev/sda2 -f path/to/lost/file -r

The small R flag -r will only recover complete files, that were not overwritten. To also recover broken files, that were partially overwritten, use the big R flag -R. This will also restore not-deleted files and empty directories.

The default destination is ./RECOVERDIR which can be changed by adding the option -d path/to/dest/dir.

If a file exists in the destination directory, the new file is renamed with a trailing hash sign #.

To recover files deleted after 'five days ago':

ext4magic /dev/sdXY -f path/to/lost/file -a $(date -d -5days +%s) -r
Improve this answer
3

ext4magic just successfully restored my deleted files (including the correct filenames!), after several other methods were not successful.

Improve this answer
2

Recovering deleted or lost files using photorec and other tools

photorec can recover "more than 480 file extensions (about 300 file families)". See the full list here: https://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec.

I have written detailed instructions on recovering files using it, originally posted on Ask Ubuntu here. I have now moved that portion of that answer to here below.

I used photorec earlier today (20 Apr. 2023) to recover 192 images taking up 3.2 GB on an SD card from 2012! All images were stored to the SD card in Nov. 2012, and were subsequently deleted. The SD card has (I think) undergone multiple "reformats" since then, and photorec still found the photos from 11 years ago! It did not, however, find the 50 photos from today that we really wanted. That stinks, but it is probably because the card is damaged from old age and wear and didn't even write the photos taken today in the first place, whereas the photos from 12 years ago were written correctly back then. So, I'm guessing that the inability of phototrec to find the photos from today is not due to photorec, but is rather due to the hardware of the SD card and its flash memory controller. I can't be sure though.

Anyway, here are my full instructions from today!:

How to recover files or images from a corrupted camera SD card, memory card, drive, or disk (or just deleted files)

Tested 20 Apr. 2023 on Ubuntu 20.04 with photorec --version PhotoRec 7.1, Data Recovery Utility, July 2019.

This is how I got all of my .cr2 files I then needed to convert to .jpg and .png images as described in my other answer here.

  1. Plug in your sdcard to your computer. Open the gparted GUI to see which device the card is. Ex: mine is /dev/sdb. We need this for the next commands.

  2. Close gparted now, or else it will block the mount from showing up in your file manager later when we run the udisksctl command to mount the image.

  3. Copy all bytes from the card into an image file, so that if the card permanently fails, we still have what data we could get.

    # try to copy the data from the card once
time sudo ddrescue -d /dev/sdb sdcard.img ddrescue.log
# try 3 times to read any bad sectors which were previously marked by writing 
# their addresses into the ddrescue.log file
time sudo ddrescue -d -r3 /dev/sdb sdcard.img ddrescue.log

    Here is a sample run and output of both commands above on a 4 GB SD card:

    $ time sudo ddrescue -d /dev/sdb sdcard.img ddrescue.log
[sudo] password for gabriel: 
GNU ddrescue 1.23
Press Ctrl-C to interrupt
     ipos:    4072 MB, non-trimmed:        0 B,  current rate:  10878 kB/s
     opos:    4072 MB, non-scraped:        0 B,  average rate:  15785 kB/s
non-tried:        0 B,  bad-sector:        0 B,    error rate:       0 B/s
  rescued:    4072 MB,   bad areas:        0,        run time:      4m 17s
pct rescued:  100.00%, read errors:        0,  remaining time:         n/a
                              time since last successful read:         n/a
Finished                                     

real    4m25.189s
user    0m1.399s
sys 0m18.838s

$ time sudo ddrescue -d -r3 /dev/sdb sdcard.img ddrescue.log
[sudo] password for gabriel: 
GNU ddrescue 1.23
Press Ctrl-C to interrupt
Initial status (read from mapfile)
rescued: 4072 MB, tried: 0 B, bad-sector: 0 B, bad areas: 0

Current status
     ipos:        0 B, non-trimmed:        0 B,  current rate:       0 B/s
     opos:        0 B, non-scraped:        0 B,  average rate:       0 B/s
non-tried:        0 B,  bad-sector:        0 B,    error rate:       0 B/s
  rescued:    4072 MB,   bad areas:        0,        run time:          0s
pct rescued:  100.00%, read errors:        0,  remaining time:         n/a
                              time since last successful read:         n/a
Finished

real    0m5.310s
user    0m0.036s
sys 0m0.000s

  4. Change the owner of sdcard.img to my username and group:

    sudo chown "$USER:$USER" sdcard.img

  5. Manually eject and remove the SD card. Be sure to right-click on your SD card in your file manager GUI and go to "Eject" or "Safely remove drive" or whatever. Then, wait for the prompt which says it's okay to remove it, before removing it, or else you risk further data corruption.

  6. Mount the sdcard.img image we produced above. See here.

    # mount the image
udisksctl loop-setup --file sdcard.img

# You will see a new disk pop up in your file manager GUI. Click on it.
# Make note of the path it goes to. 
# Ex: `/media/gabriel/EOS_DIGITAL`

# Now look for that path here, and make note of the loop filesystem that 
# path is mounted to!:
df -h
# Example, mine is this:
#       /dev/loop13p1              3.8G  160K  3.8G   1% /media/gabriel/EOS_DIGITAL
# We will need this `/dev/loop13p1` part in the recovery process.

  7. Now recover the data, following the instructions here: https://www.tomshardware.com/how-to/recover-deleted-files-from-any-drive-in-linux. In short:

    sudo apt install testdisk

# Open the terminal GUI-like interactive program to do the recovery!
sudo photorec

# Make your selections appropriately. Choose to recover from the
# `/dev/loop13p1` image/filesystem you mounted above.

# Note: you'll have to specify an output folder too. Manually make a folder
# to store recovered images, and tell the GUI-like program to use it.

  8. When done, you may have a bunch of .cr2 images in your specified output recovery folder.

    And that brings us to my other answer here! Convert those unfriendly .cr2 images into usable .jpg or .png images by following the steps in that answer under the section titled "How to batch convert hundreds of .cr2 images into .jpg or .png images".

    If that worked for you: the end.

Also check out the paid EaseUS tool below. I'd be willing to bet it's a more-effective product for those willing to pay for it.

Other file recovery tools

There are some other alternatives listed here: https://alternativeto.net/software/easeus-data-recovery-wizard/?platform=linux

Alos, EaseUS, a paid option, has written a really great article here, mentioning 5 total Linux data recovery options, with 4 of them being free and open source and no-cost: EaseUS.com: 2023 Best Free Linux Data Recovery Software for EXT2/EXT3.

The 4 free ones that EaseUS mentions are:

  1. R-Linux
    1. This one looks the most useful and robust to me! It would be one of the first ones I'd try after photorec, shown above.
    2. https://www.easeus.com/data-recovery/linux-ext2-ext3-data-recovery-freeware.html#part2
    3. https://www.r-studio.com/free-linux-recovery/
    4. https://www.r-tt.com/downloads/Free_Linux_Recovery_Manual.pdf
  2. TestDisk
    1. https://www.easeus.com/data-recovery/linux-ext2-ext3-data-recovery-freeware.html#part3
    2. https://en.wikipedia.org/wiki/TestDisk
  3. ddrescue
    1. https://www.easeus.com/data-recovery/linux-ext2-ext3-data-recovery-freeware.html#part4
    2. https://www.gnu.org/software/ddrescue/
  4. PhotoRec
    1. This is the one I have had good success with, and present above!
    2. https://www.easeus.com/data-recovery/linux-ext2-ext3-data-recovery-freeware.html#part5
    3. https://en.wikipedia.org/wiki/PhotoRec

Other:

  1. recoverjpeg:
    1. You can try recoverjpeg too. Follow instructions here: https://linuxnightly.com/how-to-recover-deleted-photos-in-linux-with-recoverjpeg/. But, in my case, photorec was able to recover 258 files, including 192 images taking up 3.2 GB, while recoverjpeg was only able to recover 11 JPEG images taking up 19.8 MB. So photorec is the clear winner in my case! Try both out for yourself though.

Paid file recovery tools:

  1. EaseUS
    1. I'm sure there are many paid tools out there, but the first one I'd recommend trying is EaseUS, even though it's expensive (start by trying the "Free Trial" option first!). I recommend it since it's mentioned by Tom's Hardware here (Tom's Hardware: How to Securely Erase an SSD or HDD Before Selling It or Your PC -> search the page for "EaseUS"), and I trust Tom's Hardware.
    2. The major con of EaseUS is that is runs on Windows and Mac only! It can recover Linux filesystems, but to do so, you must run the software on a Windows boot disk on your Linux machine, for example, or you must remove your Linux hard drive, put it into an external enclosure, and plug it into a Windows or Mac machine. Personally, I'd try the Windows boot disk option using a free Windows ISO image directly from Microsoft.

References

Recovering files and images:

  1. Google search for "linux ddrescue into file": https://www.google.com/search?q=linux+ddrescue+into+file&oq=linux+ddrescue+into+file&aqs=chrome..69i57.13329j0j9&sourceid=chrome&ie=UTF-8
    1. ***** https://www.technibble.com/guide-using-ddrescue-recover-data/
  2. Google search for "linux recover deleted images" - https://www.google.com/search?q=linux+recover+deleted+images&oq=linux+recover+deleted+images&aqs=chrome..69i57.3625j0j7&sourceid=chrome&ie=UTF-8
    1. ***** https://www.tomshardware.com/how-to/recover-deleted-files-from-any-drive-in-linux
  3. How to mount an image: https://unix.stackexchange.com/a/619834/114401
  4. my answer on ddrescue and stuff
  5. My blog post on ddrescue: https://www.electricrcaircraftguy.com/2018/01/how-to-clone-your-hard-drive.html
  6. Official photorec and testdisk wikis, by CGSecurity.org, their maker: https://www.cgsecurity.org/wiki/PhotoRec
  7. List of all file formats/extensions which can be recovered by photorec: https://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec

See also

  1. [my answer] How to convert CR2 to JPG or PNG?
  2. This photorec tutorial here, which I firs saw in the main answer: How to Recover Corrupt jpeg and mov Files from a Digital Camera's SDD Card on Fedora/CentOS/RHEL
Improve this answer
3
  • 1
    photorec worked for me, but it took a couple of hours to restore the deleted file.
    – VectorVortec
    Commented Feb 28 at 8:00
  • @VectorVortec, which command took a couple hours to complete?
    – Gabriel Staples
    Commented Feb 28 at 17:38
  • 1
    Photorec, itself, took about 25 minutes, and it produced a couple hundred files that had different names than the original name. A simple grep reduced the number to about 75 files. I concocted a scheme using grep and shell to find out which file was the correct one (it was there). That scheme required about a hundred manual commands, but it worked.
    – VectorVortec
    Commented Feb 29 at 18:57
1

This might save the trouble for some of you.
If you ever used gedit to edit that file, by default a copy of that file will be created.
For example let's suppose we have accidentaly deleted 'myfile.txt'.
In the folder that used to contain the file you have just deleted use these commands and you'll recover the copy from there:
ls | grep 'myfile.txt~'
With a bit of luck you'll find it and then:
cp 'myfile.txt~' 'myfile.txt'
I have recovered a file just now using this method. Best of luck!

Improve this answer
0

When you delete a file, the link count in the inode table for that file is decreased by one. In Unix, when the link count drops down to 0, the data blocks for that file are marked as free and typically, references to those data blocks are lost. I just discovered from @fedorqui's comment that there may be some way to access those blocks but that is only applicable to ext3 filesystem.

One way to preserve the files will be to write a function that will allow you to move the files to a trash area (let us say $HOME/.trash) and recover the needed files from there. This function can be aliased to rm. You can schedule a cron job to delete the files that have been in the trash area for a certain number of days.

Improve this answer
0

Is this just outdated or have I misunderstood something?

When I have deleted a file, I can find it back in

~/.local/share/Trash/files$

It is a normal waste bin like in Windows.

Improve this answer
2
  • 1
    In desktop environments, by default file is moved to trash not deleted from filesystem.
    – PeterM
    Commented Sep 24, 2022 at 15:59
  • @PeterM Therefore, the answer does not answer the question, since the question is about anything that was removed with rm on the command line - which then does not get moved trash.
    – questionto42
    Commented Sep 28, 2022 at 20:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .