How to Restore an Overwritten File on Linux

By Lindsay Howell

Linux is an operating system that runs on Unix computers. Users can control computers with the Linux OS using a command line interface or a graphical interface. Backing up your files on a computer that operates with Linux is important because file recovery can be tricky. If you accidentally delete or overwrite files while working on a Linux computer, you will need to enter commands using the Linux interface to retrieve the lost files.

Step 1

Assess which partition on your computer you need to access to recover the files.

Step 2

Unmount the directory using the "unmount" command in the interface. This will help prevent damaging the file you are trying to recover.

Step 3

Type "debugfs" in the command line interface (all typing without quotation marks) and include the file system where the overwritten file is into the command. For example, typing "debugfs usr/personal" will bring up your personal directory. Hit "Enter" after typing the command.

Step 4

Use the "Isdel" command by typing "Isdel" in the command line interface and hitting "Enter" while the system is being debugged. This will bring up a list of overwritten and deleted files in the file system.

Step 5

Recover the overwritten files by typing the command "dump filename" in the command line interface and hitting "Enter."

Step 6

Type in the "inode" number associated with the files you want to retrieve, which is located in the first column that is displayed in by the "Isdel" command.

Tips & Warnings

  • Make backup copies of important files and store them in your personal directory to prevent overwriting them.
  • Turning off your computer while trying to retrieve overwritten files in Linux can corrupt those files.

References & Resources