How to Recover Deleted Files in Linux
Despite best efforts, there are times when you accidentally delete files you still need. There are even times when you delete a file that you don't realize you'll need later. It's best to simply back up files prior to deleting them, since it can be a hassle to recover them. Even so, it is possible to recover deleted files in Linux if you know how.
Things You'll Need
Determine the partition in which the file you wish to recover was located. You can do this easily using the "pwd" command in the shell console.
Unmount the current directory using the "unmount" command. This will limit the potential that the file will be overwritten while you try to recover it. Be aware that this is not possible if the file is located in the "/root" directory since it is always mounted. In this case, you'll need to remove the hard drive and place it in another Linux based PC and continue the recovery procedure (a very dangerous option, but the only one available in this case).
Use the "debugfs" command. The "debugfs" command is used to handle most major errors and bugs that can occur in Linux. It enables you to correct problems without having to suffer a system crash or cause a restart. Include the file system where the deleted files are located: "debugfs usr/personal" would access the usr/personal directory.
Use the "lsdel" once you have begun the debug of the file system. This command generates a list of all of the files that have been deleted on the file system. Be patient, as this can take a long time when you're dealing with larger caches of deleted files.
Recover those files you wish to undelete by typing "dump filename". The "inode number" is the number displayed in the first column of the report you receive when using the "lsdel" command. This will write those files to the current partition you are working in, backing up those files.
Tips & Warnings
- There are third party file recovery applications available for many operating systems, including Linux. Such applications recover deleted files by either storing a backup in a special partition or simply helping you recover them before those sectors are overwritten. There is no foolproof way to recover deleted files, however.
- There is never a guarantee that you can recover deleted files if you haven't backed them up. Sometimes Linux will end up overwriting sectors on your hard drive that contained the deleted files you wish to recover. Always back up your important files prior to deleting them.