Linux восстановление удаленных файлов через rm

How to Recover a File deleted with rm

Suffering a loss of data can be a terrifying experience. Many causes jump to mind immediately – malware attack, consequences of running the wrong command, software-level data corruption, or even your failing hard drive acting up. But you know what’s even worse? Doing the damage yourself by formatting the entire drive, partition, or folder! And while there is certain failsafe put in place on Windows, Mac, and Linux in the form of a Recycle Bin/Trash Can, accidents can easily happen. One of the most common causes for accidental deletion on Linux based operating systems is the rm command. So, with that out of the way, here’s how to recover a file deleted with rm.

What is an rm command?

The rm command, which stands for remove, is used for removing files, symbolic links, and directories from UNIX-based file systems, most commonly Linux, Fedora, Manjaro, and Ubuntu. Here is how it works with three files named one.txt, two.txt, and three.txt. You can also replace the names with file paths to directories to delete folders.

Deleting one file

1. Open Terminal (On Ubuntu, click the Ubuntu icon in the top-left corner, and type terminal. Or, use the keyboard shortcut Ctrl + Alt + T).
2. Enter rm one.txt into the Terminal.
3. Press Enter.

Deleting multiple files

1. Open Terminal.
2. Enter rm one.txt two.txt three.txt into the field.
3. Press Enter.

Why is rm command dangerous?

If you tested this, you would have noticed that the files were deleted without asking for confirmation, and without any notifications. This is because the default rm command is designed to work silently by default, and to only notify the user in case there was an error of some kind. Also, the files weren’t sent to the Recycle Bin/Trash Can but deleted permanently. This can wreak havoc on your operating system.

Here are two options that won’t be of use after the files are lost, but will act as a safeguard for the future.

1. Option 1. Use interactive deletion. It will ask you to confirm the delete process for every single file by pressing Y on your keyboard. Simply type rm -i one.txt into the Terminal.
2. Option 2. Download and install therm-trash utility. It acts as a prevention from accidentally deleting files by guaranteeing they’ll be sent to the Trash Can. After installing the utility, you can type rm-trash one.txt into the Terminal to delete a file.

Is file recovery possible after an rm command?

It could very well be – there are a lot of factors involved. We’ll try and give you a few tips.

1. After you run an rm command, leave the drive be. Do not download, copy, or install anything new, as you risk overwriting the important data.
2. Power down the system or unmount the partition. This might not be useful if you already suffered data loss but might save you from a disaster in the future. This is especially useful if you accidentally run an rm command on the entire drive or a large partition. Since there will be a certain delay before the command is “propagated” to the disk, it is possible to cancel the process by interrupting it.
3. Try and remember if you created a backup. Even if you get files that are a bit old, you’d still be better off than if you had an empty drive.
4. Hire professionals. We’ve already discussed data recovery services and their benefits. If you have important files that you cannot afford to lose, paying someone with decades of experience gives you the highest chance of recovery.

How to restore files deleted with rm command using Terminal

Finding files of different formats other than text makes things very difficult. Here’s how to recover a text file, which will still require a lot of browsing around.

1. Open Terminal.
2. Type init 1 and press Enter. This will switch the system to a single user mode.
3. In most cases, you’ll use this command. Type grep -i -a ‘MyFile’ /dev/[partition-name] > file.txt
   • -i will ignore case distinctions e.g. match uppercase and lowercase characters
   • -a will process any binary file as if it was a text
   • MyFile indicates the word your desired file starts with. Replace it with the one that matches yours
   • Replace [partition-name] with the partition the text files are on. For example, /dev/sda2

How to recover files on Linux using data recovery software

Using terminal without any additional help to browse for files other than plain text is not worth the effort. Instead, we recommend using software on our list of best data recovery software for Linux and Ubuntu. We’ve handpicked some, to show you how they work.

TestDisk and PhotoRec are both from the same “family” of free, open-source software and are often used together. Plus, they are both lightweight and portable and thus require no installation. And, just so you know, Linux uses various file systems, most often ext2, ext3, and ext4.

TestDisk

1. Download TestDisk for Linux and extract it from the archive.
2. Once you open the program, you’ll be met with a window similar to a Terminal, although with a primitive user interface.
3. Scroll down using your keyboard and choose Advanced.
4. Find the partition/drive that the lost data is on, and choose Undelete. Press Enter.
5. After the process is complete, you’ll see deleted files in red.
6. As a safety feature, TestDisk doesn’t “recover” files, but rather chooses to copy them to a separate partition for safekeeping. Once you highlight a file, press C on your keyboard to copy the file.
7. Use the arrow keys as described to navigate through directories until you find a file path to copy the recovered files to.

PhotoRec

1. Download PhotoRec for Linux from the same link above. (TestDisk and PhotRec come bundled in the same archive).
2. Extract the archive and run the program.
3. Choose media (drive, partition, USB drive, SD card, etc.) from the list by using the arrow keys, and press Enter.
4. Highlight the ext file system.
5. Navigate to File Opt using the arrow keys and press Enter. Enable or disable the extensions of file types you want PhotoRec to search for.
6. Once you proceed, you will be asked to confirm the file system. Choose EXT2/EXT3.
7. Pick between scanning unallocated files only (recently deleted files) or the whole partition (time-consuming but thorough).
8. Pick the output folder/partition for the recovered files on your drive.
9. Give the software some time to finish. You can track the progress and see the total number of files it recovered sorted by file extensions.
10. Highlight Quit once the search is complete, and press Enter.

How to backup files on Linux

Once you got your files back, make sure you don’t go through the same stress again. This is done through frequently backing up your files, often to an external HDD. The process can also be automated. Linux has a rsync command that can be entered into Terminal and via various parameters, unlock a full set of features. We think having a graphical user interface (GUI) to the command is much better, and recommend luckyBackup.

1. Open Terminal.
2. On Ubuntu, type sudo apt-get install luckybackup
3. Choose a name for the backup and pick Backup Source inside Destination as the Type.
4. Pick the Source (the folder you want to back up, or an entire partition) and Destination (your external HDD/USB flash drive).
5. Put checkmarks in front of the types of files you want to backup.
6. You can choose to create multiple snapshots. Those are “points in history” that you can reroll your files to at will, for example, a certain day and/or time of the day, depending on the configurations.

File Recovery Limitations and Best Practices

1. Time-Sensitive Recovery

After accidentally deleting files with the rm command, time becomes a critical factor. The longer you wait to attempt file recovery, the higher the risk of data overwriting. As soon as you realize the deletion, it’s crucial to take immediate action and refrain from any further disk operations to increase the chances of successful recovery.

2. Avoid Writing to the Same Disk

To prevent potential data overwriting, it’s essential to avoid writing any new data to the disk from which the files were deleted. This includes installing software, downloading files, or even browsing the internet. Writing new data increases the likelihood of overwritten sectors, making file recovery more challenging or even impossible.

3. Recovery from Unmounted Disks

If you accidentally delete files from a disk or partition, consider unmounting them immediately. Unmounting the disk ensures that no further write operations occur, reducing the risk of data overwriting. You can unmount a disk using the ` umount ` command followed by the disk or partition name. For example, ` umount /dev/sda1 `.

4. Use Live CDs and Data Recovery Tools

Additional to the software for data recovery listed in the article, there are additional tools that can help you recover erased files. Using bootable USB devices or live CDs with data recovery-oriented operating systems can assist create a secure environment for file recovery without running the risk of additional data loss.

5. Consult Professional Data Recovery Services

If your files are highly valuable, irreplaceable, or the recovery process seems complex, it’s advisable to consult professional data recovery services. These experts have the necessary tools, expertise, and clean room environments to perform advanced file recovery procedures. Also, keep in mind that professional data recovery services can be high-priced, and success is not guaranteed in all suits.

6. Prevention is Key

While file recovery methods exist, it’s crucial to prioritize prevention to avoid the need for recovery altogether. Implementing a reliable backup strategy ensures that even in the event of accidental deletion, you have a copy of your files readily available.

You may improve the possibility of successful file recovery and decrease the danger of long-term data loss by being aware of these restrictions and adhering to the best practices.

Источник

How to recover the deleted files using «rm -R» command in linux server? [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.

This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.

I have unfortunately deleted some important files and folders using ‘rm -R ‘ command in Linux server. Is there any way to recover?

U can use «rm-trash» utility from github.com/nateshmbhat/rm-trash . It puts the files into trash and handles duplications , permissions etc.

3 Answers 3

since answers are disappointing I would like suggest a way in which I got deleted stuff back.

I use an ide to code and accidently I used rm -rf from terminal to remove complete folder. Thanks to ide I recoved it back by reverting the change from ide’s local history.

(my ide is intelliJ but all ide’s support history backup)

On Windows, with WebStorm 2017.2: select the folder that contained what you deleted, then in menu VCS..Local History..Show History you can find the file you deleted, select it, then click the Revert Selection button in the toolbar. Thanks, saved me some time!

Short answer: You can’t. rm removes files blindly, with no concept of ‘trash’.

Some Unix and Linux systems try to limit its destructive ability by aliasing it to rm -i by default, but not all do.

Long answer: Depending on your filesystem, disk activity, and how long ago the deletion occured, you may be able to recover some or all of what you deleted. If you’re using an EXT3 or EXT4 formatted drive, you can check out extundelete .

In the future, use rm with caution. Either create a del alias that provides interactivity, or use a file manager.

Источник