Loading ...Linux or UNIX Recover deleted files - undelete files
If you rum rm command accidentally and deleted important a file, recovery becomes critical under Linux and/or UNIX oses.
Since Linux is multiuser and multitasking operating system other users/process can overwrite deleted file disk space. So you need to take down system to single user mode.
First use wall (only the super-user can write on the terminals of users) command write a message to all users, then use init (process control initialization) command to take system to single user mode.
Procedure
Following are generic steps to recover text files.
First use wall command to tell user that system is going down in a single user mode:
# wallOutput:
System is going down to .... please save your work.
Press CTRL+D to send message.
Next use init 1 command to take system to a single user mode:
# init 1
Using grep (traditional UNIX way) to recover files
Use following grep syntax:
grep -b 'search-text' /dev/partition > file.txt
OR
grep -a -B[size before] -A[size after] 'text' /dev/[your_partition] > file.txt
Where,
- -i : Ignore case distinctions in both the PATTERN and the input files i.e. match both uppercase and lowercase character.
- -a : Process a binary file as if it were text
- -B Print number lines/size of leading context before matching lines.
- -A: Print number lines/size of trailing context after matching lines.
To recover text file starting with "nixCraft" word on /dev/sda1 you can try following command:
# grep -i -a -B10 -A100 'nixCraft' /dev/sda1 > file.txt
Next use vi to see file.txt. This method is ONLY useful if deleted file is text file. If you are using ext2 file system, try out recover command. .
See also:
- See Recover homepage for more information
Want to stay up to date with the latest Linux tips, news and announcements? Subscribe to our free e-mail newsletter or RSS feed to get all updates.
You can Email this page to a friend.
You may also be interested in other helpful articles:
- Linux recover deleted files with lsof command - howto
- Howto: Recover lost files after you accidentally wipe your hard drive
- Linux: Recovering deleted /etc/shadow password file
- PostgreSQL get back storage occupied by deleted tuples or records
- How to MySQL backup and data recovery with mysql-zrm
Discussion on This Article:
Leave a Reply
We encourage your comments, and suggestions. But please stay on topic, be polite, and avoid spam. Thank you very much for stopping by our site!
please show the whole procedure slide by slide so that layman can understand better.
the files in /var directory have gone missing in our solaris server.is there any way we can recover it???????please help
sridhar,
There is no real undelete available (until and unless you go for 3rd party commercial software). Restore file from backup. If it is config file restore by copying 3rd system or reinstalling package.
Appreciate your post.
i have removed .xsd files now i want them back.can anyone help me to get my .xsd files.
Thanks in advance