Can files/directories deleted with rm be restored?
Is it possible to restore files/directories which are deleted from terminal using rm and rm -r ?. If a file is deleted from graphical interface, it could be restored from trash, but how do you restore a file if it is removed using the rm utility?.
for tools to recover deleted files (in any form), you can take a look at this question askubuntu.com/q/3883
Don’t use «rm» if you wish to restore the files in future .You can use «rm-trash» utility : github.com/nateshmbhat/rm-trash
8 Answers 8
To this end I use trash-cli package and the following alias in my ~/.bashrc
And the trash-cli package can be installed by the followoing command: sudo apt-get install trash-cli .
The files you remove will be moved to trash, and you can see them in nautilus trashcan.
You can always access the real rm by using one of the following method:
command rm something 'rm' something \rm something There are also commands to access the trashcan from terminal, trash-list , restore-trash (or trash-restore ), trash-empty installable from package trash-cli (then see their man pages).
Last note, it is not advisable to use such an alias for super-user, because it can interfere with system operations.
I think the user also would to know if there is some method to achieve the same behavior from command line. If not, I am ready to remove my answer.
«it is not advisable to use such an alias for super-user» can you explain this a bit more please? What kind of system operations could be affected and what might the negative consequences be?
Deleting it from terminal deletes it permanently — recovery is very hard and sometimes impossible.
If your partition type is ext3 (check it by using the System->Administration->Disk Utility ), then take a look at ext3undel.
If it is not (if you installed Ubuntu with default settings), try the extundelete program.
There is no guarantee you will recover anything though.
You are looking for: extundelete — utility to recover deleted files from ext3/ext4 partition
To find such a package, you can try: apt-cache search undelete
To use the utility install it with: sudo apt-get install extundelete
After installation invoke man extundelete and study it carefully.
Just as an alternative, if you know specifically what type of file it is.
sudo apt-get install foremost Now open up /etc/foremost.conf and you will see a long list of commented out lines. If your file type exists, uncomment the line (you may also want to remove the irrelevant lines).
If your file type does not exist, add your own line. Say I want to recover a .css file and I know its around 40K. I could do add this:
css n 40000 Theme\sName: Plugin\sFixes The 2nd column refers to case-sensitivity, the third column refers to the upper limit for size, the 4th column is how the file starts (remember to use escaped characters) and the last column is how the file usually ends.
Use the following command (edit the disk accordingly. could check with df command)
foremost -v -T -c /etc/foremost.conf -i /dev/sda -o output What will happen next is that foremost will create a folder called output and dump all the recovered data (in this case) into the folder. From there you could use diff or meld to compare the recovered ‘files’ and see which is the most up to date.
thanks a lot. It worked perfectly. I accidentally removed my php source file using rm -fr php/ with 2 php files. Less than 2 minutes they were recovered perfectly. In the .conf file I added: php n 40000 ASCII
Speaking in the most abstract terms, whenever you delete a file on the graphical interface, the file is «moved» to a special «buffer», a directory called trash . You can locate it in your home directory, ~/.local/share/Trash/ . Files «deleted» from this directory, will be really deleted. This real deletion is what happens when you use rm on a file.
It’s extremely hard to recover deleted files. Files in the file system are represented as nodes on a B-tree or the like. When a file is deleted using rm , the tree is updated, number of hardlinks are reduced, the corresponding entry in the directory listing is removed. If at all, your file had a hard link, your file is absolutely safe. You can do a file / -samefile filename . You can search the file if you remember its inode number too (this is hardly the case).
Another case is when none of the above possibilities is true. Whenever you rm a file, the file entry on the directory is removed, reducing the number of hardlinks by one. And if the number of hard links drops to zero, then the pointer to the file on the inode is dropped, or is marked to be deleted. Either way, your file «still» resides on the hard disk. The file is actually erased from hard disk only on subsequent remount. File recovery at such a time is extremely hard, involves going through the file system tree and the inodes representing actual disk block locations. There’s a popular tool I’ve heard of, but never used it, called extundelete . Although there’s no guarantee, its worth giving a try.
Once you recover your files successfully or not, make haste to do regular backups. It’s extremely simple on Ubuntu.
How to undo rm -rf? [closed]
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
But it was my mistake and want to recover that Application folder, but it’s not in Trash folder. What should I do now? Is there any command to undo rm -rf ?
In principle you cannot undo rm (or unlink(2) which it would call). Learn to make backups, and to use version control systems (like git . ) for your source files.
1 Answer 1
Short answer: you can’t¹. Files that get unlinked are irreversibly gone. If you really cared about what you deleted (e.g. personal files that cannot be reproduced), you could run photorec and try to recover as many files as possible, but you will loose any directory structure and naming.
Anyway, since you deleted the Applications folder, reinstalling everything could be the simple way to go. Provided that Applications folder contained installed applications.
1: some filesystems (will) support undeletion, but it’s not your case.
FAT16 notably does. Undeletion was planned for EXT4, but has never been implemented afaik, also because EXT4 is being phased out in favour of BTRFS. Anyway, there is an external tool for undeleting files on EXT3/4, extundelete.
@StefanoSanfilippo the extundelete tool saved my life. I accidentally deleted all files from my home (in my case, by typo rm -rf ~ ), however, the extundelete recovered some important files (certificates, invoices, large virtual machine files etc.) into a folder called RECOVERED_FILES . Thanks for indicating it!
How to recover files I deleted now by running rm *? [duplicate]
By mistake I ran rm * on the current directory where I created many c program files. I had been working on these since morning. Now I can’t take out again the time that I spent since morning on creating the files. Please say how to recover. They aren’t in recycle bin also!
There are SOME ways to recover files/data. But most of them is very hard to do. Be sure you don’t write any more to the disk or you are doomed completely.
When I did this, when I was young, it was not as bad as I thought. This is how I discovered that most of the time taken to write is in thinking. The second time around there will be less thinking, and you may even improve it.
Unmount the file system ASAP to avoid the blocks previously allocated for the deleted files from being overwritten. Assuming the underlying file system is either ext3 or ext4 , you might have some luck recovering files using extundelete .
2 Answers 2
If a running program still has the deleted file open, you can recover the file through the open file descriptor in /proc/[pid]/fd/[num] . To determine if this is the case, you can attempt the following:
If the above gives output of the form:
progname 5383 user 22r REG 8,1 16791251 265368 /path/to/file take note of the PID in the second column, and the file descriptor number in the fourth column. Using this information you can recover the file by issuing the command:
$ cp /proc/5383/fd/22 /path/to/restored/file If you’re not able to find the file with lsof , you should immediately remount the file system which housed the file read-only:
$ mount -o remount,ro /dev/[partition] or unmount the file system altogether:
The reason for this is that as soon as the file has been unlinked, and there are no remaining hard links to the file in question, the underlying file system may free the blocks previously allocated for the deleted file, at which point the blocks may be allocated to another file and their contents overwritten. Ceasing any further writes to the file system is therefore time critical if any recovery is to be possible. If the file system is the root file system or cannot be made read-only or unmounted for some other reason, it might be necessary to shutdown the system (if possible) and continue the recovery from a live environment where you can leave the target file system read-only.
After writes to the file system have been prevented, there is no immediate hurry to attempt the actual recovery. To play it safe, you might want to make a backup of the file system to perform the actual recovery on:
$ dd bs=4M if=/dev/[partition] of=/path/to/backup The next steps now depend on the file system type. Assuming a typical Ubuntu installation, you most likely have a ext3 or ext4 file system. In this case, you may attempt recovery using extundelete . Recovery may be attempted safely on either the backup, or the raw device, as long as it is not mounted (or it is mounted read-only). DO NOT ATTEMPT RECOVERY FROM A LIVE FILE SYSTEM. This will most likely bring the file system to an inconsistent state.
extundelete will attempt restore any files it finds to a subdirectory of the current directory named RECOVERED_FILES . Typical usage to restore all deleted files from a backup would be:
$ extundelete /path/to/backup --restore-all With newer versions (e.g. 0.2.4), don’t mount the device you’re trying to recover from (thanks to Ryan Lue) :
$ extundelete /dev/ --restore-all Instead of —restore-all , you can try options like —restore-file or —restore-directory