LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
LinkBack Search this Thread
Old 07-19-2012, 05:16 AM   #1
ramecare
Member
 
Registered: Feb 2011
Posts: 176

Rep: Reputation: 0
How to recover deleted files in linux


Dear all,

Accidently i have deleted the ram.conf file in the directory /opt and i want to recover the deleted file ram.conf in /opt directory and followed the below website link to recover my file but i was not able to recover,can any one help me on this

http://www.cyberciti.biz/tips/linuxu...ted-files.html

Thanks,
 
Old 07-19-2012, 05:22 AM   #2
sharadchhetri
Member
 
Registered: Aug 2008
Location: INDIA
Distribution: Redhat,Debian,Suse,Windows
Posts: 179

Rep: Reputation: 23
Quote:
Originally Posted by ramecare View Post
Dear all,

Accidently i have deleted the ram.conf file in the directory /opt and i want to recover the deleted file ram.conf in /opt directory and followed the below website link to recover my file but i was not able to recover,can any one help me on this

http://www.cyberciti.biz/tips/linuxu...ted-files.html

Thanks,
I used scalpel that is nice tool. but u have to configure scalpel./etc/scalpel/scalpel.conf

for more ref.
http://www.linuxforu.com/2011/09/rec...iles-in-linux/
 
Old 07-19-2012, 05:25 AM   #3
ramecare
Member
 
Registered: Feb 2011
Posts: 176

Original Poster
Rep: Reputation: 0
Hi sharadchhetri,

Without using any third party tool i need to recover my deleted file and whether it is possible to do with command line.

Thanks,
 
Old 07-19-2012, 05:26 AM   #4
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Arch/XFCE
Posts: 17,802

Rep: Reputation: 728Reputation: 728Reputation: 728Reputation: 728Reputation: 728Reputation: 728Reputation: 728
I don't know about scalpel---might be interesting.

If you delete using the GUI, then check the trash. If you delete in a terminal (CLI), there is no trash---and therefor no "official" way of recovering the file.
 
Old 07-19-2012, 05:28 AM   #5
sharadchhetri
Member
 
Registered: Aug 2008
Location: INDIA
Distribution: Redhat,Debian,Suse,Windows
Posts: 179

Rep: Reputation: 23
Quote:
Originally Posted by sharadchhetri View Post
I used scalpel that is nice tool. but u have to configure scalpel./etc/scalpel/scalpel.conf

for more ref.
http://www.linuxforu.com/2011/09/rec...iles-in-linux/
lsof|grep filename

get process id no.

cd /proc/process_id_no.

inside search you will get the file and copy it. As you have init 1 already might be it is not opened.

use scalpel tool otherwise. but u have to configure its /etc/scalpel/scalpel.conf

http://www.linuxforu.com/2011/09/rec...iles-in-linux/
 
Old 07-19-2012, 05:30 AM   #6
sharadchhetri
Member
 
Registered: Aug 2008
Location: INDIA
Distribution: Redhat,Debian,Suse,Windows
Posts: 179

Rep: Reputation: 23
Quote:
Originally Posted by sharadchhetri View Post
lsof|grep filename

get process id no.

cd /proc/process_id_no.

inside search you will get the file and copy it. As you have init 1 already might be it is not opened.

use scalpel tool otherwise. but u have to configure its /etc/scalpel/scalpel.conf

http://www.linuxforu.com/2011/09/rec...iles-in-linux/
ignore my last tool advise, I was bit late to see other post
 
Old 07-19-2012, 05:33 AM   #7
ramecare
Member
 
Registered: Feb 2011
Posts: 176

Original Poster
Rep: Reputation: 0
Hi !

When i run the command lsoft | grep 'ram.conf' i did'nt get any process id and i got the output as blank

Thanks,
 
Old 07-19-2012, 05:40 AM   #8
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 11,795

Rep: Reputation: 923Reputation: 923Reputation: 923Reputation: 923Reputation: 923Reputation: 923Reputation: 923Reputation: 923
Restore from your latest backup ...
 
Old 07-19-2012, 05:47 AM   #9
ramecare
Member
 
Registered: Feb 2011
Posts: 176

Original Poster
Rep: Reputation: 0
I dont have backup for that file and i have to recover my file and is there any other way to recover my file
 
Old 07-19-2012, 05:52 AM   #10
sharadchhetri
Member
 
Registered: Aug 2008
Location: INDIA
Distribution: Redhat,Debian,Suse,Windows
Posts: 179

Rep: Reputation: 23
Quote:
Originally Posted by ramecare View Post
I dont have backup for that file and i have to recover my file and is there any other way to recover my file
df -h
know from which partition you deleted the file.

eg.

debugfs -w /dev/sda2

you will get prompt like
debugfs:

type lsdel,like

debugfs: lsdel


let me know what is the output
 
1 members found this post helpful.
Old 07-19-2012, 06:02 AM   #11
ramecare
Member
 
Registered: Feb 2011
Posts: 176

Original Poster
Rep: Reputation: 0
Please find the below output
I have deleted ram.conf file in /opt directory
Output:

[root@itsupport ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda7 24G 23G 0 100% /
/dev/sda6 99M 12M 83M 12% /boot
tmpfs 1010M 0 1010M 0% /dev/shm

[root@itsupport ~]# debugfs -w /dev/sda7
debugfs 1.39 (29-May-2006)
debugfs: lsdel
Inode Owner Mode Size Blocks Time deleted
0 deleted inodes found.
debugfs:

Thanks,

Last edited by ramecare; 07-19-2012 at 06:03 AM.
 
Old 07-19-2012, 06:15 AM   #12
sharadchhetri
Member
 
Registered: Aug 2008
Location: INDIA
Distribution: Redhat,Debian,Suse,Windows
Posts: 179

Rep: Reputation: 23
Quote:
Originally Posted by ramecare View Post
Please find the below output
I have deleted ram.conf file in /opt directory
Output:

[root@itsupport ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda7 24G 23G 0 100% /
/dev/sda6 99M 12M 83M 12% /boot
tmpfs 1010M 0 1010M 0% /dev/shm

[root@itsupport ~]# debugfs -w /dev/sda7
debugfs 1.39 (29-May-2006)
debugfs: lsdel
Inode Owner Mode Size Blocks Time deleted
0 deleted inodes found.
debugfs:

Thanks,

I am working on your issue and I found it in my system

try once again.

debugfs -w /dev/sda7
debugfs: cd /opt
debugfs: ls -d

tell me the status,it should list that .conf file , I need its inode no. <some_no.118282>

Last edited by sharadchhetri; 07-19-2012 at 06:25 AM.
 
Old 07-19-2012, 06:25 AM   #13
ramecare
Member
 
Registered: Feb 2011
Posts: 176

Original Poster
Rep: Reputation: 0
[root@itsupport ~]# debugfs -w /dev/sda7
debugfs 1.39 (29-May-2006)
debugfs: cd /opt
debugfs: ls -ld
5064161 40755 (2) 0 0 4096 19-Jul-2012 15:21 .
2 40775 (2) 0 0 4096 19-Jul-2012 15:32 ..
5098317 40755 (2) 0 0 4096 21-Jun-2012 19:09 mysqlstudy
5073036 40755 (2) 0 0 4096 2-Jun-2012 22:39 Godaddy remaining
4290867 100644 (1) 0 0 17348 9-Jul-2012 15:04 enquiry.php
4290868 100644 (1) 0 0 15149 9-Jul-2012 15:05 index.php
< 0> 0 (1) 0 0 0 medsonsdb09072012.sql
< 0> 0 (1) 0 0 0 ram.conf
5072756 100644 (1) 0 0 58292 10-Jul-2012 18:27 sendmailnkup.cf
5072755 100644 (1) 0 0 2638 10-Jul-2012 19:06 emailmessage
debugfs:

Yes now iam able to view my deleted file ram.conf from the output and now how can i recover ram.conf file.

Thanks,
 
Old 07-19-2012, 06:40 AM   #14
sharadchhetri
Member
 
Registered: Aug 2008
Location: INDIA
Distribution: Redhat,Debian,Suse,Windows
Posts: 179

Rep: Reputation: 23
Quote:
Originally Posted by ramecare View Post
[root@itsupport ~]# debugfs -w /dev/sda7
debugfs 1.39 (29-May-2006)
debugfs: cd /opt
debugfs: ls -ld
5064161 40755 (2) 0 0 4096 19-Jul-2012 15:21 .
2 40775 (2) 0 0 4096 19-Jul-2012 15:32 ..
5098317 40755 (2) 0 0 4096 21-Jun-2012 19:09 mysqlstudy
5073036 40755 (2) 0 0 4096 2-Jun-2012 22:39 Godaddy remaining
4290867 100644 (1) 0 0 17348 9-Jul-2012 15:04 enquiry.php
4290868 100644 (1) 0 0 15149 9-Jul-2012 15:05 index.php
< 0> 0 (1) 0 0 0 medsonsdb09072012.sql
< 0> 0 (1) 0 0 0 ram.conf
5072756 100644 (1) 0 0 58292 10-Jul-2012 18:27 sendmailnkup.cf
5072755 100644 (1) 0 0 2638 10-Jul-2012 19:06 emailmessage
debugfs:

Yes now iam able to view my deleted file ram.conf from the output and now how can i recover ram.conf file.

Thanks,
do not use
ls -ld

use
ls -d

I need inode no. like this <265263>
 
Old 07-19-2012, 06:43 AM   #15
arun5002
Member
 
Registered: Aug 2011
Location: Chennai,India
Distribution: Redhat,Centos,Ubuntu,Dedian
Posts: 548
Blog Entries: 5

Rep: Reputation: Disabled
Hi
Use the following commands

#lsof -pwln | grep deleted check whether file is still opened in any file descriptor


#lsof -Pwln | grep deleted
nautilus 1383 1000 20r REG 8,6 376 11723317 /home/arun/.local/share/gvfs-metadata/home (deleted)
nautilus 1383 1000 21r REG 8,6 32768 11723318 /home/arun/.local/share/gvfs-metadata/home-a427f454.log (deleted)
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How recover deleted files in redhat linux basith7861 Linux - Newbie 2 05-03-2011 05:29 AM
LXer: Recover deleted files in linux with Photorec LXer Syndicated Linux News 0 10-12-2009 09:41 AM
[SOLVED] How to recover deleted files from a fat32 volume in Linux? colucix Linux - General 10 07-13-2009 05:11 AM
recover deleted windows files from linux(help) rkrishna Linux - General 2 06-22-2005 11:32 AM
Recover deleted files from a Win partition in Linux? PenguinPwrdBox Linux - General 3 08-03-2004 04:05 AM


All times are GMT -5. The time now is 11:41 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration