Linux recover deleted files with lsof command – howto

Almost 2 years back I wrote about recovering deleted text file with grep command under UNIX or Linux.

Michael Stutz shows us how to recover deleted files using lsof command.

From the article:
There you are, happily playing around with an audio file you’ve spent all afternoon tweaking, and you’re thinking, “Wow, doesn’t it sound great? Lemme just move it over here.” At that point your subconscious chimes in, “Um, you meant mv, not rm, right?” Oops. I feel your pain — this happens to everyone. But there’s a straightforward method to recover your lost file, and since it works on every standard Linux system, everyone ought to know how to do it.

Briefly, a file as it appears somewhere on a Linux filesystem is actually just a link to an inode, which contains all of the file’s properties, such as permissions and ownership, as well as the addresses of the data blocks where the file’s content is stored on disk. When you rm a file, you’re removing the link that points to its inode, but not the inode itself; other processes (such as your audio player) might still have it open. It’s only after they’re through and all links are removed that an inode and the data blocks it pointed to are made available for writing.

This delay is your key to a quick and happy recovery: if a process still has the file open, the data’s there somewhere, even though according to the directory listing the file already appears to be gone.


However recovering files under Linux is still hard work for new admins. I highly recommend backing up files regularly and storing backup offsite.

🐧 If you liked this page, please support my work on Patreon or with a donation.
🐧 Get the latest tutorials on SysAdmin, Linux/Unix, Open Source & DevOps topics via:
CategoryList of Unix and Linux commands
File Managementcat
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network Utilitiesdig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
32 comments… add one
  • dheeraj suthar Oct 25, 2012 @ 8:59

    Thanks a ton! the article helped me a lot.. accidentally deleted a very important file .. recovered like a charm.. Thanks again!

  • Kailash Suthar Oct 6, 2012 @ 5:00

    Hi Guys,
    Accidentaly I deleted all of my folders using
    rm -rf ~/
    It contained some important data. I need those
    data back.Can any body help me in this regard.

    Thanks in advance,
    Kailash Suthar

  • RAKESH Sep 18, 2012 @ 20:44

    I trash some files and folders from desktop in Linux , I want to restore it then how to do with it.
    Plz relpy

  • sai Jun 28, 2012 @ 6:08

    Accidentaly I deleted all of my folders using
    rm -rf * in suse linux9 environment
    It contained some important data. I need those
    data back.Can any body help me in this regard.

    Thanks in advance,

  • Madhukar kumar Jan 12, 2011 @ 5:39

    Hi Guys,
    Accidentaly I deleted all of my file using
    rm -rf *
    It contained some important data. I need those
    data back.Can any body help me in this regard.

    Thanks in advance,
    Madhukar kumar.

  • vinay Dec 2, 2010 @ 6:21

    in my centos server configuration files has been deleted due to accident. i want to recover that files tell me how can i recover those files.

  • Panacea Oct 1, 2010 @ 18:55

    Hello all,
    All the files in my directory has been accidentally deleted on an SGI server using the rm -r command. None of the files are backed up. Please, can anyone help me out with possibility of recovering my files? It will highly be appreciated and acknowledged. Thanks.

  • rizqan Sep 30, 2010 @ 18:17

    i deleted a folder(opt) with command rm -r foldername in i want bring it can i bring it back?can u help me in this plz…..

  • mozmel Aug 7, 2010 @ 19:17

    i have some files deleted from linux and i want to recover it with orginal names>>
    can any one help me to do that?

  • Poorna Chandra Jul 15, 2010 @ 3:39

    How to recover the Deleted files in linux(edubuntu)
    please accidentally i deleted my important folder

  • Peter Stoelzgen Jan 21, 2010 @ 21:38

    Like some other people I did something very stupid.
    I deleted my home directory using the following command:
    userdel -r pedro

    After I read your article I approached the problem in the following way:
    lsof | grep /home/pedro

    I receive a four line answer:
    bash 4414 root cwd DIR 8,2 0 8085505 /home/pedro (deleted)
    lsof 5650 root cwd DIR 8,2 0 8085505 /home/pedro (deleted)
    grep 5651 root cwd DIR 8,2 0 8085505 /home/pedro (deleted)
    lsof 5652 root cwd DIR 8,2 0 8085505 /home/pedro (deleted)

    Is there any possibility to recover the whole directory by setting some values manually.
    Please write back,

Leave a Reply

Your email address will not be published. Required fields are marked *

Use HTML <pre>...</pre>, <code>...</code> and <kbd>...</kbd> for code samples.