Can files/directories deleted with rm be restored?
Is it possible to restore files/directories which are deleted from terminal using rm and rm -r ?. If a file is deleted from graphical interface, it could be restored from trash, but how do you restore a file if it is removed using the rm utility?.
for tools to recover deleted files (in any form), you can take a look at this question askubuntu.com/q/3883
Don’t use «rm» if you wish to restore the files in future .You can use «rm-trash» utility : github.com/nateshmbhat/rm-trash
8 Answers 8
To this end I use trash-cli package and the following alias in my ~/.bashrc
And the trash-cli package can be installed by the followoing command: sudo apt-get install trash-cli .
The files you remove will be moved to trash, and you can see them in nautilus trashcan.
You can always access the real rm by using one of the following method:
command rm something 'rm' something \rm something There are also commands to access the trashcan from terminal, trash-list , restore-trash (or trash-restore ), trash-empty installable from package trash-cli (then see their man pages).
Last note, it is not advisable to use such an alias for super-user, because it can interfere with system operations.
I think the user also would to know if there is some method to achieve the same behavior from command line. If not, I am ready to remove my answer.
«it is not advisable to use such an alias for super-user» can you explain this a bit more please? What kind of system operations could be affected and what might the negative consequences be?
Deleting it from terminal deletes it permanently — recovery is very hard and sometimes impossible.
If your partition type is ext3 (check it by using the System->Administration->Disk Utility ), then take a look at ext3undel.
If it is not (if you installed Ubuntu with default settings), try the extundelete program.
There is no guarantee you will recover anything though.
You are looking for: extundelete — utility to recover deleted files from ext3/ext4 partition
To find such a package, you can try: apt-cache search undelete
To use the utility install it with: sudo apt-get install extundelete
After installation invoke man extundelete and study it carefully.
Just as an alternative, if you know specifically what type of file it is.
sudo apt-get install foremost Now open up /etc/foremost.conf and you will see a long list of commented out lines. If your file type exists, uncomment the line (you may also want to remove the irrelevant lines).
If your file type does not exist, add your own line. Say I want to recover a .css file and I know its around 40K. I could do add this:
css n 40000 Theme\sName: Plugin\sFixes The 2nd column refers to case-sensitivity, the third column refers to the upper limit for size, the 4th column is how the file starts (remember to use escaped characters) and the last column is how the file usually ends.
Use the following command (edit the disk accordingly. could check with df command)
foremost -v -T -c /etc/foremost.conf -i /dev/sda -o output What will happen next is that foremost will create a folder called output and dump all the recovered data (in this case) into the folder. From there you could use diff or meld to compare the recovered ‘files’ and see which is the most up to date.
thanks a lot. It worked perfectly. I accidentally removed my php source file using rm -fr php/ with 2 php files. Less than 2 minutes they were recovered perfectly. In the .conf file I added: php n 40000 ASCII
Speaking in the most abstract terms, whenever you delete a file on the graphical interface, the file is «moved» to a special «buffer», a directory called trash . You can locate it in your home directory, ~/.local/share/Trash/ . Files «deleted» from this directory, will be really deleted. This real deletion is what happens when you use rm on a file.
It’s extremely hard to recover deleted files. Files in the file system are represented as nodes on a B-tree or the like. When a file is deleted using rm , the tree is updated, number of hardlinks are reduced, the corresponding entry in the directory listing is removed. If at all, your file had a hard link, your file is absolutely safe. You can do a file / -samefile filename . You can search the file if you remember its inode number too (this is hardly the case).
Another case is when none of the above possibilities is true. Whenever you rm a file, the file entry on the directory is removed, reducing the number of hardlinks by one. And if the number of hard links drops to zero, then the pointer to the file on the inode is dropped, or is marked to be deleted. Either way, your file «still» resides on the hard disk. The file is actually erased from hard disk only on subsequent remount. File recovery at such a time is extremely hard, involves going through the file system tree and the inodes representing actual disk block locations. There’s a popular tool I’ve heard of, but never used it, called extundelete . Although there’s no guarantee, its worth giving a try.
Once you recover your files successfully or not, make haste to do regular backups. It’s extremely simple on Ubuntu.
How To Recover Deleted Files In Linux [Beginner’s Guide]
Brief: This article shows you how to recover deleted files in Linux using command line tool Test Disk. It’s an easy to use tool that almost anyone can use to recover lost files in Ubuntu or other Linux distributions.
Have you ever gotten that horrible feeling? The one you get when you realize that you accidentally deleted files and it’s not even in the trash? Often it is immediately preceded by denial: I know I have another copy of it somewhere.
But rather than going through all the stages of grief, don’t worry. And remember you’re not alone; sooner or later everyone does this.
“Don’t worry?” you counter, “I just erased the only copy of my resume!”
No really, don’t worry. All that’s happened is that it’s been bumped off a list. So long as you don’t write onto the drive, it absolutely still exists. In fact, depending on the size of the file and the free space on your drive deleted files can persist indefinitely—even if you do write on the drive.
“Yes, fine” you say, “I’ll rest easy knowing my resume ‘exists’ in some abstract sense. But so far as I’m concerned if I can’t open, edit or print from it, it doesn’t exist in any practical sense. What would really help would be a way to ‘un-delete’ files. And one that doesn’t require an IT forensics lab.”
Really, don’t worry—you don’t need a lab to recover the deleted files. Furthermore, if you can get past using a primitive GUI, it’s actually easy to do! I’ll show you how to use TestDisk to recover deleted files.
How to recover deleted files in Linux using TestDisk
Let me present a simplified example: I took a clean thumb drive added some files, then deleted one. Now, my system has a feature which will directly delete files from removable media, by-passing the “trash” altogether; that is if I choose to “right” click on a file and then choose “delete”. It still presents a warning, but one click on the “yes” button and the file is gone forever. Or appears to be.
But this time I didn’t get that horrible feeling. And no, not because this is a cooked up scenario. I knew that all I had to do was open the terminal type “testdisk” and hit “enter”. When I did this for the first time I had one of my “Linux moments”. Because if you don’t have it—and I didn’t—it tells you how to get it! Just type “sudo apt install testdisk” and enter and you’ll have it in about 10 seconds.
If you prefer videos, you can watch this video of the same tutorial on It’s FOSS YouTube channel:
Screens that have extra commands will tell you so. Also note that TestDisk 7.0 tends to highlight the next reasonable step. It’s almost always right but do read the screen, since it can’t read your mind. In any case, when it wants you to let it create a log file, indulge it. It’s about to pull you out of a hole.
Step 4
Now, at this point, if you’re lucky, you should see your drive. And you can proceed to the last steps. But let’s assume you’re not, that you have, say, a multi-boot machine. In this case, ownerships can get blurry, and Testdisk needs your permission to open them. You’ll see something like this:
Select “sudo” and enter your password. Hit “enter” and “enter” again on the next screen to create another log file.
Step 5
This time Testdisk displays all your drives. Arrow key to the drive in question and hit enter.
Step 6
Testdisk has again selected the correct setting. This makes sense since a simple storage device is seldom partitioned. Again hit enter:
Step 7
And finally we have to do a little thinking to do. If you read the first screen—and I’ll bet you didn’t—this program isn’t just for recovering deleted files. It’s a powerful disk utility. But if we remember what we’re trying to do the choice is fairly obvious: we’re not trying to fix a disk, we’re trying to recover a file. Select “Advanced” and hit “enter”.
Step 8
At the bottom of the page choose “Undelete” and get ready to see a ghost!
Step 9
Testdisk will scan for files and produce a list of deleted files highlighted in red. Arrow down to it and carefully read the choices at the bottom.
Step 10
Again, bear in mind that Testdisk is a multi-function tool. Most of these options deal with groups of files; we only want our damn resume back! So hit “c”.
As you can see from the scoreboard, we’ve won 1-0. After hitting “c” there are options about where you might want to recover the file to, but it defaults to your home folder. And again this is generally the best thing to do. Navigating in Testdisk is a little tricky, whereas dragging and dropping after the fact is a breeze.
A few tips on recovering deleted files in Linux using TestDisk
First, if you find yourself somewhere you don’t want to be, hit “q” for quit. This won’t close the program, instead, it will act like the “back” button on a program with a full blown GUI, and put you back a page. And just like a “back” button repeating will eventually lead you back to the beginning.
Second, as with anything, the fewer the distractions, the easier it is to find what you’re looking for. In other words, physically detach all other storage drives. In graphically simple environments simplicity is your friend.
Finally, Testdisk can also help you retrieve files that have become inaccessible for other reasons. In fact, this is why I started using the program in the first place. I was trying to save files from a corrupted drive that could not be made to boot. Normally it’s simply a matter of removing said drive any hooking it up to a USB adapter. You can then mount it on another PC and copy the files where ever you want.
But what if the drive is formatted to LVM? This was my problem because a mounted LVM drive looks nothing like a normal Linux OS. None of the usual files appear, and hunting around simply doesn’t help. This, among other reasons, is because most Linux file managers can no longer read ext.2 file systems.
Nevertheless, after a few false starts, I was able to find and save the missing files. Note, however, that the sequence of steps here will be a little different, you may need to use the “analyze” option for Testdisk to make sense of the drive and you may have to poke around a little to find the “home” folder once you do. Furthermore, the files you’re looking for will not appear in red since they were never deleted in the first place. But once you do find them, the copying procedure is basically the same.
With Testdisk and a little luck, you may never lose your resume again as you can always recover deleted files in Linux.
Disclaimer: This tutorial is a reader submission.
Dave Merritt
I’m a 59 years old, fulltime landscaper and parttime PCmedic. I’ve been an avid Linux user for over ten years. In that time, I do not claim to have made every possible mistake, only most of them. I’m a big fan of prog rock, avant jazz and J S Bach, and enjoy reading Neal Stevenson and anything to do with the foundational problems in modern physics.