Linux recover deleted files with lsof command – howto

by on November 17, 2006 · 32 comments· LAST UPDATED January 5, 2009

in , ,

Almost 2 years back I wrote about recovering deleted text file with grep command under UNIX or Linux.

Michael Stutz shows us how to recover deleted files using lsof command.

From the article:
There you are, happily playing around with an audio file you've spent all afternoon tweaking, and you're thinking, "Wow, doesn't it sound great? Lemme just move it over here." At that point your subconscious chimes in, "Um, you meant mv, not rm, right?" Oops. I feel your pain -- this happens to everyone. But there's a straightforward method to recover your lost file, and since it works on every standard Linux system, everyone ought to know how to do it.

Briefly, a file as it appears somewhere on a Linux filesystem is actually just a link to an inode, which contains all of the file's properties, such as permissions and ownership, as well as the addresses of the data blocks where the file's content is stored on disk. When you rm a file, you're removing the link that points to its inode, but not the inode itself; other processes (such as your audio player) might still have it open. It's only after they're through and all links are removed that an inode and the data blocks it pointed to are made available for writing.

This delay is your key to a quick and happy recovery: if a process still has the file open, the data's there somewhere, even though according to the directory listing the file already appears to be gone.

Read more at Linux.com

However recovering files under Linux is still hard work for new admins. I highly recommend backing up files regularly and storing backup offsite.

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

{ 32 comments… read them below or add one }

1 sridhar January 8, 2007 at 10:59 am

i think the OS files in my solaris server have been deleted accidentally.i would like to know if there is any way to recover the files.

Reply

2 Shakeel February 12, 2007 at 2:24 pm

I delete a whole data in home folder by rm -rf * then
how i recover the data pls reply me

Reply

3 mondarino March 21, 2007 at 4:58 pm

Is is not correct, This is for open-deleted files

Reply

4 Madan May 10, 2007 at 7:03 am

I delete a whole folder which having data by rm -rf * then
how i recover the data pls reply me

thx in adv – madan

Reply

5 abhi July 17, 2007 at 3:53 pm

I accidently deleted a whole folder from my home directory.
How i recover my lost data plz reply

Reply

6 danny0085 April 4, 2008 at 4:40 am
7 guna April 25, 2008 at 4:18 am

I want recover the deleted files and directory command. Please help me give proceture.

Reply

8 manoj May 20, 2008 at 2:48 pm

Hi Guys,
Accidentaly I deleted all of my folders using
rm -rf *
It contained some important data. I need those
data back.Can any body help me in this regard.

Thanks in advance,
Manoj.

Reply

9 manoj May 20, 2008 at 2:49 pm

This is a nice site which can help us in urgent.

Reply

10 Ashish Amre August 2, 2008 at 6:52 am

Some one destroyed all my vpses now I want to recover data please help me how to recover that data.

Reply

11 Chetan December 17, 2008 at 8:41 am

System->Administration->Software Sources. From the terminal I installed Foremost:
sudo apt-get install foremost

You need to know your target partition’s path to recover from it. I simply started System-Administration->Partition Editor and saw the the home partition is /dev/sda1.

Let’s recover some JPEG images:
sudo foremost -t jpeg -i /dev/sda1

This command causes Foremost to create a directory called output and put every file it can recover in. This could take a while.

Reply

12 Iain January 4, 2009 at 9:39 pm

You don’t actually link to the article on Linux.com, it’s here: http://www.linux.com/articles/58142

Reply

13 Sanjay sachdeva May 15, 2009 at 5:14 am

By mistake i delete my file by rm command, file name is myprog.tgz. This file contains all my programs. Can any one help me for recover this file.

Reply

14 Winfried Buechert June 20, 2009 at 8:55 am

Hi,
I just managed to recover a script, that was still running in an endless loop, but I deleted the File:
./doit &
rm doit
lsof | grep doit (you get the PID, you get the INUM also, but that did not help)
cat /proc//fd/255 (outputs the script)

Reply

15 Winfried Buechert June 20, 2009 at 8:59 am

the editor deleted the PID, use this:
cp /proc/PID/fd/255 recovered

Reply

16 sanjat September 22, 2009 at 7:26 am

hello
Actually I have deleted a file by using “shift+delete”..
i want to recover it
m using fedora core 10
please help
thank you in advance

Reply

17 Moon October 1, 2009 at 7:10 pm

Hi Manoj,
If you follow step by step from this site you might recover the file.

http://www.cyberciti.biz/tips/linuxunix-recover-deleted-files.html

That guides to have you in a level than try to search your directory or file either by grep or locate command.

Regards,

Reply

18 Emma October 28, 2009 at 11:35 am

I delete a whole data in home folder by rm -rf * then
how i recover the data pls reply me at the earliest possible. I am in mess….

Reply

19 jim November 23, 2009 at 9:19 pm

I have moved files from a directory to a computer on the network and have since discovered that the drive they were moved to is bad. It is my sense that moving and deleting are largely the same process, is there a best way to recover the files from the directory they were moved from? THANKS! -jim-

Reply

20 Bhanu November 24, 2009 at 9:02 am

i have deleted one important files on lamp server.
is there any idea to recover that files from server.
plssssss replyyyyyy m n messsss

Reply

21 Peter Stoelzgen January 21, 2010 at 9:38 pm

Hi.
Like some other people I did something very stupid.
I deleted my home directory using the following command:
userdel -r pedro

After I read your article I approached the problem in the following way:
lsof | grep /home/pedro

I receive a four line answer:
bash 4414 root cwd DIR 8,2 0 8085505 /home/pedro (deleted)
lsof 5650 root cwd DIR 8,2 0 8085505 /home/pedro (deleted)
grep 5651 root cwd DIR 8,2 0 8085505 /home/pedro (deleted)
lsof 5652 root cwd DIR 8,2 0 8085505 /home/pedro (deleted)

Is there any possibility to recover the whole directory by setting some values manually.
Please write back,
Pedro

Reply

22 Poorna Chandra July 15, 2010 at 3:39 am

How to recover the Deleted files in linux(edubuntu)
please accidentally i deleted my important folder

Reply

23 mozmel August 7, 2010 at 7:17 pm

hi
i have some files deleted from linux and i want to recover it with orginal names>>
can any one help me to do that?
thanks

Reply

24 rizqan September 30, 2010 at 6:17 pm

i deleted a folder(opt) with command rm -r foldername in linux.now i want bring it back.how can i bring it back?can u help me in this plz…..

Reply

25 Panacea October 1, 2010 at 6:55 pm

Hello all,
All the files in my directory has been accidentally deleted on an SGI server using the rm -r command. None of the files are backed up. Please, can anyone help me out with possibility of recovering my files? It will highly be appreciated and acknowledged. Thanks.

Reply

26 vinay December 2, 2010 at 6:21 am

in my centos server configuration files has been deleted due to accident. i want to recover that files tell me how can i recover those files.

Reply

27 Madhukar kumar January 12, 2011 at 5:39 am

Hi Guys,
Accidentaly I deleted all of my file using
rm -rf *
It contained some important data. I need those
data back.Can any body help me in this regard.

Thanks in advance,
Madhukar kumar.

Reply

28 Hatami May 4, 2012 at 8:51 am

Hi,
You could use TestDisk and PhotoRec for linux distro to recover all data.
download it from : http://www.cgsecurity.org/wiki/TestDisk_Download

Regards,
Hatami.

Reply

29 sai June 28, 2012 at 6:08 am

Hi
Accidentaly I deleted all of my folders using
rm -rf * in suse linux9 environment
It contained some important data. I need those
data back.Can any body help me in this regard.

Thanks in advance,
sai.

Reply

30 RAKESH September 18, 2012 at 8:44 pm

Hi
I trash some files and folders from desktop in Linux , I want to restore it then how to do with it.
Plz relpy

Reply

31 Kailash Suthar October 6, 2012 at 5:00 am

Hi Guys,
Accidentaly I deleted all of my folders using
rm -rf ~/
It contained some important data. I need those
data back.Can any body help me in this regard.

Thanks in advance,
Kailash Suthar

Reply

32 dheeraj suthar October 25, 2012 at 8:59 am

Hi,
Thanks a ton! the article helped me a lot.. accidentally deleted a very important file .. recovered like a charm.. Thanks again!

Reply

Leave a Comment

Previous post:

Next post: