How to Recover Deleted Files in Linux

We all sometimes delete important files accidently. And sometimes we delete a few files thinking that they aren’t important, but later we might realize that we need them. It is best to keep a backup of files so that they can be easily recovered when they are required later. But even if you didn’t keep a backup, it is still possible to regain the deleted files in your Linux system. Let’s see how:

1. Find the partition in which the deleted file was stored. To do this, you can use the pwd command (print working directory) at the shell console.

2. Now unmount the present directory by using the unmount command. This command will limit the chances of overwriting the file while trying to recover it. Be conscious of the fact that this would not be possible if that file is present in the root directory because that directory is always mounted. If that is the case, you will have to remove the hard disk and keep it in some other Linux based computer, and then proceed with the recovery process. Though it’s a risky option, but it is the only available option in such a case.

3. Run the debugfs command. This command can handle almost all major bugs and errors that crop up in Linux. It allows you to fix problems without a reboot or a system crash. Include the path where deleted files are present.

debugfs usr/personal will access the user or personal directory.

4. Once you have started file system debugging, use the isdel command. It shows a series of files that were deleted on the given file system. It can take a long time to list all the files if the cache of deleted files is large.

5. Recover the files that you want, by typing dump <file name>. The first column of the displayed report will show inode number. This command will write the desired files to the present partition, and back those files up.

Notes:

· There are some third party recovery software applications that are present for a number of operating systems like Linux. These applications recover files by either saving backups in a separate partition, or by helping you in recovering them before those sectors get overwritten. But if you are looking for a foolproof way to recover deleted files, you will be disappointed.

· If you haven’t kept a backup of your files, there is no guarantee of getting them back. Sometimes, Linux might overwrite the sectors of your hard disk that had deleted files that you wanted to recover. If that happens, your files are lost forever. So it is best to keep a backup of all the important files.

Once you recover the lost files, make sure you back them up as soon as possible. Backing them up will reduce the chances of them being deleted again. If you have a lot of important information on your system, it is best to buy a recovery tool and use it in case you delete a file accidently.


Blogsphere: TechnoratiFeedsterBloglines
Bookmark: Del.icio.usSpurlFurlSimpyBlinkDigg
RSS feed for comments on this post
 |  TrackBack URI for this post


2 Responses to “How to Recover Deleted Files in Linux”

  1. Robert Karen says:

    I am using Ubuntu 11.04 but never tried this so I try it and found it very interesting and useful.Thanks for posting

  2. Stacy Craig says:

    You are welcome :)

Leave a Reply