how to recover deleted data??
 

HI,

I have deleted a very important data from my linux OS.Is there any way of recovering the data???

Most will probably say, recover from your backup.

If you can it will be tough. First of all, you need to stop witting to the disk as each write could overwrite the file(s) you want to restore.

Then you need to give us more information.

- What filesystem?
- What is the data you need to recover (file, files, small, large)?

I'd probably clone the disk to an image and work from a copy of the image. That way, you're system is back up and you can take your time and try out several possibilities.

I managed to recover small files from ext3 but it was not easy. I never managed to recover large ones.

Best of luck.

If data was important, how did you delete in first place?
Also it would be helpful if you could give more information. You did not say how did you delete it? You do not say what OS and FS it is. And did you overwrite it in some way?

If it is very important, then make an image of the partition before preceding. You don't want the data being overwritten.

One program that can recover files is photorec.

Also there is the "debugfs" command that can undelete an inode. You can run "debugfs /dev/sd##" as root, enter "cd /dir/path/" and then "lsdel" to list deleted files. Then "undel <inode> filename" where inode is the inode number. You need the angle brackets for this command.

e.g.
undel <110123> /data/filename

This assumes that debugfs can find it. This command is for ext2/3 filesystems.

If you know what kind of file it is or some of the contents, you could try hunting for it on an image of the filesystem and try to cut it out using dd.

There may also be an undelete command. Check sourceforge.

---

Working from a live cd may be a good idea instead of keeping your system live.

Often recommended is "testdisk" (Same author as photorec---which was mentioned above) I have successfully used photorec, but not testdisk.

Ditto the comments about not writing to the drive.

my FS in ext2 and OS is RHEL4...i already tried debugfs....deleted with rm -rf....

You have not responded to all of the advice given so far......if you don't try what we suggest, then we can't be much help to you.

I'll add one more tip: If the data is really valuable, and you are uncomfortable with learning about file recovery, then get the drive to a professional recovery service.

Photorec - I assure is the Best Option.
You will surely get it back..Its Powerful...

I very good example why -rf option should be used very carefully with rm.

Jschiwals advice is really nice.

It is quite cool to see what debugfs can do.

Am in middle of trying to recover a file automatically
deleted from the /tmp directory (my son -- who didn't
understand till now, not to be working in the /tmp directory)

Given /ext3 file system, I just get .
As I've read elsewhere, if you delete in ext3 with rm, or
your OS deletes for you, then you haven't got inodes to work with.

I tried to grep the whole file-system as follows

To find any occurence of Potter from Harry Potter on my /home partition.
If you are root -- this can be done but turns out non-productive. It seems for most of
the search strings I came up with that this just spits out lots and lots of gibberish.
Sometimes you can tell why the lines matched, other times they are a few thousand characters long
and the target doesn't even seem to appear on screen.

Further -- I was really trying to find the contents of an .odt file, and those, of course,
are in some encoded binary format, so grepping for readable text does not work. If only
one identified in advance the file to be lost and saved it as ordinary text -- it would be better (grin).