Linux or UNIX Recover deleted files – undelete files

If you rum rm command accidentally and deleted important a file, recovery becomes critical under Linux and/or UNIX oses.

Since Linux is multiuser and multitasking operating system other users/process can overwrite deleted file disk space. So you need to take down system to single user mode.

First use wall (only the super-user can write on the terminals of users) command write a message to all users, then use init (process control initialization) command to take system to single user mode.

Procedure

Following are generic steps to recover text files.

First use wall command to tell user that system is going down in a single user mode:
# wallOutput:

System is going down to .... please save your work.

Press CTRL+D to send message.

Next use init 1 command to take system to a single user mode:
# init 1

Using grep (traditional UNIX way) to recover files

Use following grep syntax:
grep -b 'search-text' /dev/partition > file.txt
OR
grep -a -B[size before] -A[size after] 'text' /dev/[your_partition] > file.txt
Where,

• -i : Ignore case distinctions in both the PATTERN and the input files i.e. match both uppercase and lowercase character.
• -a : Process a binary file as if it were text
• -B Print number lines/size of leading context before matching lines.
• -A: Print number lines/size of trailing context after matching lines.

To recover text file starting with "nixCraft" word on /dev/sda1 you can try following command:
# grep -i -a -B10 -A100 'nixCraft' /dev/sda1 > file.txt

Next use vi to see file.txt. This method is ONLY useful if deleted file is text file. If you are using ext2 file system, try out recover command. .

See also:

• See Recover homepage for more information

------------------------------------More reference

using grep command, unnecessary data which matches with the given string will added in the output file. so i thing it is not good method to restore deleted files

------------------

Christophe GRENIER January 3, 2009 at 3:28 am

http://www.cgsecurity.org/wiki/PhotoRec

PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from Hard Disks and CDRom and lost pictures (thus, its ‘Photo Recovery’ name) from digital camera memory. PhotoRec ignores the filesystem and goes after the underlying data, so it will still work even if your media’s filesystem has been severely damaged or re-formatted.

PhotoRec is free, this open source multi-platform application is distributed under GNU Public License. PhotoRec is a companion program to TestDisk, an app for recovering lost partitions on a wide variety of filesystems and making non-bootable disks bootable again. You can download them from this link.

For more safety, PhotoRec uses read-only access to handle the drive or memory support you are about to recover lost data from. Important: As soon as a pic or file is accidentally deleted, or you discover any missing, do NOT save any more pics or files to that memory device or hard disk drive; otherwise you may overwrite your lost data. This means that even using PhotoRec, you must not choose to write the recovered files to the same partition they were stored on.
PhotoRec runs under

* DOS/Win9x
* Windows NT 4/2000/XP/2003/Vista
* Linux
* FreeBSD, NetBSD, OpenBSD
* Sun Solaris
* Mac OS X

and can be compiled on almost every Unix system.
Photorec ignores the filesystem, this way it works even if the filesystem is severely damaged.

It can recover lost files at least from

* FAT,
* NTFS,
* EXT2/EXT3 filesystem
* HFS+

ReiserFS includes some special optimizations centered around tails, a name for files and end portions of files that are smaller than a filesystem block. In order to increase performance, ReiserFS is able to store files inside the b*tree leaf nodes themselves, rather than storing the data somewhere else on the disk and pointing to it. Unfortunately, PhotoRec isn’t able to deal with this, it’s why it doesn’t work well with ReiserFS.

------------

I just had to recover a file from ext3 on Ubuntu, and used the utility ext3grep to do so.

It’s in the Ubuntu repositories, so install it before you need it:
sudo aptitude install ext3grep

And remember, if you are storing your backups encrypted, keep the password to the encrypted folder in a file SEPARATELY (not in the encrypted folder), so when you delete it, you can just restore it, rather than get that ‘sinking feeling’…
I was lucky, ext3grep worked for me – I had to follow the manual recovery examples on the ext3grep homepage, the auto recovery didn’t do it for me.