Is it possible to recover filed removed by rm in linux?

Question

In windows filed deleted can be find in trash if you didn't press shift,

what about the files deleted by rm -f in linux

Answer 1

The first thing to remember is -- stop doing any further write-activities on the filesystem.

Then you can try some tools that will look at the filesystem and try to locate data in the deleted node. 'extundelete' is one such tool at sourceforge.

extundelete is a utility that can recover deleted files from an ext3 or ext4 partition. The ext3 file system is the most common file system when using Linux, and ext4 is its successor. extundelete uses the information stored in the partition's journal to attempt to recover a file that has been deleted from the partition. There is no guarantee that any particular file will be able to be undeleted, so always try to have a good backup system in place, or at least put one in place after recovering your files!

Answer 2

I'll give a try to this one, ext3grep:
http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html
You have to unmount the partition before starting.

HTH

Answer 3

The first step would be to try an undelete tool for the filesystem used for your root drive.

As mentioned, ext3grep and extundelete are the tools for the ext file system family.

Another option depending on the file type trying to be recovered is to run a file carver on the drive. This will take longer than the above utilities.

Foremost is one option I have used for this.

The final option, if you happen to know of a certain string within the file, is to open the drive in a hex editor and search for that string.

Depending on your setup, your window manager may provide a recycle bin/trash can.

At the end of the day, there's absolutely no substitute for having a good backup system setup. Find one that does its job without you touching it and set it up. You'll save yourself a lot of time, trouble, and pain in the long run.