Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In windows filed deleted can be find in trash if you didn't press shift,

what about the files deleted by rm -f in linux

share|improve this question
1  
Windows has called it a Recycle Bin for over 10 years now; and when you push delete it explicitly says it's moving the file, not deleting it. rm unlinks the i-node(s) associated with the file. –  Chris S Aug 4 '10 at 2:55
1  

3 Answers 3

The first thing to remember is -- stop doing any further write-activities on the filesystem.

Then you can try some tools that will look at the filesystem and try to locate data in the deleted node. 'extundelete' is one such tool at sourceforge.

extundelete is a utility that can recover deleted files from an ext3 or ext4 partition. The ext3 file system is the most common file system when using Linux, and ext4 is its successor. extundelete uses the information stored in the partition's journal to attempt to recover a file that has been deleted from the partition. There is no guarantee that any particular file will be able to be undeleted, so always try to have a good backup system in place, or at least put one in place after recovering your files!

share|improve this answer
2  
The no further writes can't be emphasized enough. It's not built-in, so "undeleting" is a matter of recovery software reassembling the remaining pieces before the filesystem overwrites the data with future writes. –  Jeremy M Aug 4 '10 at 2:36

I'll give a try to this one, ext3grep:
http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html
You have to unmount the partition before starting.

HTH

share|improve this answer

The first step would be to try an undelete tool for the filesystem used for your root drive.

As mentioned, ext3grep and extundelete are the tools for the ext file system family.

Another option depending on the file type trying to be recovered is to run a file carver on the drive. This will take longer than the above utilities.

Foremost is one option I have used for this.

The final option, if you happen to know of a certain string within the file, is to open the drive in a hex editor and search for that string.

Depending on your setup, your window manager may provide a recycle bin/trash can.

At the end of the day, there's absolutely no substitute for having a good backup system setup. Find one that does its job without you touching it and set it up. You'll save yourself a lot of time, trouble, and pain in the long run.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.