How to Recover Deleted Files in Linux. Despite best efforts, there are times when you accidentally delete files you still need. There are even times when you delete a file that you don't realize you'll need later. It's best to simply back up files prior to deleting them, since it can be a hassle to recover them. Even so, it is possible to recover deleted files in Linux if you know how.
Step
Determine the partition in which the file you wish to recover was located. You can do this easily using the "pwd" command in the shell console.
Step
Unmount the current directory using the "unmount" command. This will limit the potential that the file will be overwritten while you try to recover it. Be aware that this is not possible if the file is located in the "/root" directory since it is always mounted. In this case, you'll need to remove the hard drive and place it in another Linux based PC and continue the recovery procedure (a very dangerous option, but the only one available in this case).
Step
Use the "debugfs" command. The "debugfs" command is used to handle most major errors and bugs that can occur in Linux. It enables you to correct problems without having to suffer a system crash or cause a restart. Include the file system where the deleted files are located: "debugfs usr/personal" would access the usr/personal directory.
Step
Use the "lsdel" once you have begun the debug of the file system. This command generates a list of all of the files that have been deleted on the file system. Be patient, as this can take a long time when you're dealing with larger caches of deleted files.
Step
Recover those files you wish to undelete by typing "dump filename". The "inode number" is the number displayed in the first column of the report you receive when using the "lsdel" command. This will write those files to the current partition you are working in, backing up those files.
