How to Recover Deleted Files in Linux

Accidentally deleting a file in Linux can be frustrating, but there are multiple ways to recover lost files, depending on how they were deleted and your system setup. Here are different recovery methods to try.


1. Check the Trash (For GUI-Based Deletion)

If the file was deleted using a graphical file manager, it might still be in the Trash:


Open your file manager.

Navigate to the Trash or Recycle Bin.

Locate the deleted file, right-click it, and select Restore.

🔹 Note: Files deleted using the rm command do not go to the Trash—they are permanently removed.


2. Recover Open Files Using lsof (If File Is Still in Use)

If a deleted file is still being used by an active process, it might be recoverable from system memory.


A. Find Open Deleted Files

lsof | grep deleted

Displays a list of files that are still open but marked as deleted.

B. Recover the File from /proc (If Available)

cp /proc/<PID>/fd/<FD> /path/to/recovered_file

Replace:


<PID> → Process ID of the program using the file.

<FD> → File descriptor from the lsof output.

3. Recover Deleted Files Using extundelete (For ext3/ext4 Filesystems)

If the file was on an ext3 or ext4 filesystem, extundelete can attempt recovery.


A. Install extundelete

sudo apt install extundelete   # Debian/Ubuntu  

sudo yum install extundelete   # RHEL/CentOS  

B. Unmount the Affected Partition (To Prevent Overwriting)

sudo umount /dev/sdX

Replace /dev/sdX with the correct partition (e.g., /dev/sda1).


C. Recover a Specific File

sudo extundelete /dev/sdX --restore-file /path/to/deleted_file

- Restored files will be saved in the RECOVERED_FILES directory.


D. Restore All Deleted Files

sudo extundelete /dev/sdX --restore-all

4. Recover Deleted Files Using testdisk

testdisk is a powerful tool for recovering lost files and partitions.


A. Install testdisk

sudo apt install testdisk   # Debian/Ubuntu  

sudo yum install testdisk   # RHEL/CentOS  

B. Run testdisk

sudo testdisk

Select Create to generate a log file.

Choose the disk where the file was deleted.

Select Advanced → Undelete.

Browse for the deleted file and restore it.

5. Restore Deleted Files from Backups

If you have a backup system, recovering from a previous backup is often the best option.


A. Restore from rsync or cp Backups

rsync -av /backup/location/ /original/location/

B. Restore from Timeshift (For System File Recovery)

sudo timeshift --restore

C. Restore from tar or zip Archives

tar -xvf backup.tar.gz -C /restore/location/

Extracts backup files to the specified location.


Comments

Post a Comment

Popular posts from this blog

Absolute and relative path in HTML pages

HTML documents can have relative or absolute links to other web pages. Relative links keeps a visitor on the same web site. Relative links are pointers to other web pages on the same web site. They just contain this page filename. Absolute links on other hand contain full path including protocol and domain name to access the page. Absolute links can point to the same web site or they can point to a different web site.
Read more

Errors

It is a good idea to send errors in production environment to error log. Errors may contain sensitive information. Even so errors maybe helpful to development team or to QA team, errors need to be suppressed in production environment for viewing by everyone. Errors are good way to troubleshoot an issue therefore only trusted people can have access to this information. If not a trusted person get an access to this information, this information maybe used against the company and for a personal benefit. What to do in a case when there are more servers than one? Even so it is possible to inspect the log files in a single server, however it is impossible to do so when there is more than one server is available and web traffic is redirected to a different server each time. Log aggregation is needed in this case. All of the logs will be send to a central location. Logs may contain sensitive information. Please consult your company lawyer of how long logs can be stored, because logs can be use...
Read more

goto PHP operator

goto operator will skip execution of code and continue execution of a code that follows a label to which goto operator points to. If code has many goto operators, than this code probably needs a revision. It is possible to write code that executes without goto operators.
Read more