how to recover files taht got deleted by rm -ef * ?

omraj · 08-27-2009, 10:44 AM

Hi
Probably this is old questions, but didnt find the exact one.

I deleted files very inportant (.pdf,.gif, .jpeg etc) from my pen drive accidently.
OS: Linux AS 4.
file system ext3.

Command used : rm -rf *

Is there any way to recover it?

thanks in advance.

Regards...

kdelover · 08-27-2009, 10:51 AM

if am not wrong you can recover them if you are under ext2 ( am not so sure about this ) when you do rm ,the file contents are not actually deleted ,they are still on your HDD its just the link that is deleted. Its always best to have a hardlink of your important data,so that if one file is deleted by mistake,the contents of the file can be still access via the other link.

http://www.osscamp.in/blog/how-recov...command-ext3fs

See this if it helps,i never tried it myself.

w1k0 · 08-27-2009, 11:31 AM

First use dd to copy pen drive contents to a file on your hard disk:

Code:

mkdir /root/pendrive
dd if=/dev/sda1 of=/root/pendrive/pendrive.img

(Before running that command assure what device uses your pen drive).

Next try PhotoRec to recover data from pendrive.img file.

tredegar · 08-27-2009, 12:49 PM

Quote:

mkdir /root/pendrive

That should give him a "Permission Denied" (and this is his first post to LQ)

But it's a very good idea to take an image before you start playing with recovery tools (because your pendrive is un-written to, and therefore untouched by "recovery" tools )

A better way to do it might be:

Code:

dd if=/dev/sda1 of=~/pendrive.img                # copy the data over, bit-by-bit , so you have an image
mkdir ~/pendisk                                  # create a mountpoint for the image at /home/omraj/pendisk
mount -o loop -t ext3 ~/pendrive.img ~/pendisk   # mount the image

* ext3 will have to be changed if your pendrive's filesystem isn't ext3 ( most are FAT32 or type vfat - see man mount )

Now the image is mounted at ~/pendisk just as if it was a real disk. Run your recovery tools on that. If you mess up, you can always re-image your pendrive ( dd if=/dev/sda1 of=~/pendrive.img ) and start again.

Welcome to LQ!

kdelover · 08-27-2009, 01:00 PM

So is it possible to recover something that has been rmed ?? Nice info w1k0 and tredger.

omraj · 08-27-2009, 01:10 PM

Thanks to all.

But i am still unable to recover the file.

The error is

0 files saved in /home/recovery/recup_dir.
cannot create file in current durectory.
i have given 777 file permissons.
Can any one help please.

thanks...