LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 05-03-2008, 04:21 PM   #1
jasbhatti
LQ Newbie
 
Registered: May 2008
Posts: 2

Rep: Reputation: 0
Deleted File


How to Recover Deleted File in Linux
 
Old 05-03-2008, 04:41 PM   #2
jailbait
LQ Guru
 
Registered: Feb 2003
Location: Blue Ridge Mountain
Distribution: Debian Jessie, Linux Mint 17
Posts: 7,751

Rep: Reputation: 272Reputation: 272Reputation: 272
Just as you do with any other operating system you set up a backup and recovery system in Linux. When you want to recover a deleted file you restore it from your backup.

-------------------
Steve Stites
 
Old 05-03-2008, 05:16 PM   #3
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,331
Blog Entries: 55

Rep: Reputation: 3531Reputation: 3531Reputation: 3531Reputation: 3531Reputation: 3531Reputation: 3531Reputation: 3531Reputation: 3531Reputation: 3531Reputation: 3531Reputation: 3531
Hello and welcome to LQ. Sorry to see it's kind of a sad occasion that brings you here.

Quote:
Originally Posted by jasbhatti View Post
How to Recover Deleted File in Linux
Recovery depends on a few factors:
0. Filesystem type. Journalling filesystems do not just unlink like VFAT and Ext2 did, they're way more efficient making recovery harder.
1. Time of incident. The longer the space a deleted file has occupied is left that way the less chance for recovery there will be.
2. Disk activity. The amount of writing to a partition varies. Some see relatively few (/boot, /usr), some more (temp dirs) and some are written to continuously (like /var). The more a partition gets written to the higher the chance unallocated space gets reallocated.
These three together should give an indication.

Procedure-wise the first thing to do is make sure the partition is mounted read-only. Then allocate space to write to. This can be another partition, another harddisk or external media. Never write to the partition to recover from. Making a copy of the partition the deleted file is on using 'dd' makes it easy to transport it to others who may be able to help you and makes it easier to use other tools on other platforms if you so decide.

The most-used tools AFAIK still are Photorec and Foremost. Here's a link to how to use Photorec: http://www.linuxquestions.org/questi...9/#post3013131 and one for Foremost: http://www.linuxquestions.org/questi...32#post2960932. You should try Photorec first. Note that due to indication above and methods of recovery there is no guarantee the file can be recovered at all, in full or be usable.



Quote:
Originally Posted by jailbait View Post
When you want to recover a deleted file you restore it from your backup.
While it's a good hint I do not see how your answer helps the OP recover his deleted file *now*.
Couldn't you add pointers to threads with recovery commands?
TIA
 
Old 05-03-2008, 05:32 PM   #4
jailbait
LQ Guru
 
Registered: Feb 2003
Location: Blue Ridge Mountain
Distribution: Debian Jessie, Linux Mint 17
Posts: 7,751

Rep: Reputation: 272Reputation: 272Reputation: 272
Quote:
Originally Posted by unSpawn View Post

While it's a good hint I do not see how your answer helps the OP recover his deleted file *now*.
Couldn't you add pointers to threads with recovery commands?
TIA
The way that the question is worded I took it to mean "how in general?".

---------------
Steve Stites
 
Old 05-03-2008, 06:00 PM   #5
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Arch/XFCE
Posts: 17,802

Rep: Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738Reputation: 738
Without making any judgements, I've observed that the wording of the original post is quite typical of people from India and similar cultures. "How to recover" means "How do I recover from the mistake I just made?"

I'm sure that a lot of this has to do with language barriers, but there also seems to be a cultural tendency to have very terse requests.

Did someone already suggest testdisk?
 
Old 05-03-2008, 10:39 PM   #6
okos
Member
 
Registered: May 2007
Location: California
Distribution: Slackware/Ubuntu
Posts: 609

Rep: Reputation: 37
In kde you have a trash can in which you can recover a deleted file.
In commandline if you rm -fr <file> I am frankly not sure how to recover it.
Isn't there a easier way to recover a file I just accidentally deleted?
 
Old 05-03-2008, 10:56 PM   #7
Peacedog
LQ Guru
 
Registered: Sep 2003
Location: Danville, VA
Distribution: Slackware, Windows, FreeBSD, OpenBSD, Mac OS X
Posts: 5,296

Rep: Reputation: 168Reputation: 168
There is some useful, however, timely reading here concerning ext3 file systems.
Good luck. ;-)
 
Old 05-03-2008, 10:59 PM   #8
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 670Reputation: 670Reputation: 670Reputation: 670Reputation: 670Reputation: 670
If another process has the file open, you can copy it from /proc/<PID>/fd/<#>. Fd stands for file descriptor. When a program uses open() to open a file, a file descriptor is returned. The inode to a file isn't deleted until every process that has a link to the file finishes.

You could determine which files these file descriptors are for by using the file command:
Code:
file -s /proc/6680/fd/*
/proc/6680/fd/0:  symbolic link to `/dev/null'
/proc/6680/fd/1:  symbolic link to `/dev/null'
...
/proc/6680/fd/2:  symbolic link to `/dev/null'
/proc/6680/fd/20: symbolic link to `/home/jschiwal/.evolution/addressbook/local/system/addressbook.db'
...
Looking at ls -l /proc/6680/fd/20 also shows the name.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
deleted file recovery nofear3829 Linux - General 1 02-21-2008 04:04 AM
deleted /etc/inittab file linuxnewbie_2007 Linux - Newbie 2 04-19-2007 12:09 AM
Help: Accidently deleted file patske Linux - Newbie 5 02-17-2004 10:34 AM
Deleted file klmn1 Linux - Software 2 12-12-2003 07:04 AM
DLoaded a file that cannot be deleted.Please Help Me yuism Linux - Security 8 11-24-2002 03:34 PM


All times are GMT -5. The time now is 05:28 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration