Linux or UNIX Recover deleted files – undelete files

If you rum rm command accidentally and deleted important a file, recovery becomes critical under Linux and/or UNIX oses.

Since Linux is multiuser and multitasking operating system other users/process can overwrite deleted file disk space. So you need to take down system to single user mode.

First use wall (only the super-user can write on the terminals of users) command write a message to all users, then use init (process control initialization) command to take system to single user mode.


Following are generic steps to recover text files.

First use wall command to tell user that system is going down in a single user mode:
# wallOutput:

System is going down to .... please save your work.

Press CTRL+D to send message.

Next use init 1 command to take system to a single user mode:
# init 1

Using grep (traditional UNIX way) to recover files

Use following grep syntax:
grep -b ‘search-text’ /dev/partition > file.txt
grep -a -B[size before] -A[size after] ‘text’ /dev/[your_partition] > file.txt

  • -i : Ignore case distinctions in both the PATTERN and the input files i.e. match both uppercase and lowercase character.
  • -a : Process a binary file as if it were text
  • -B Print number lines/size of leading context before matching lines.
  • -A: Print number lines/size of trailing context after matching lines.

To recover text file starting with “nixCraft” word on /dev/sda1 you can try following command:
# grep -i -a -B10 -A100 'nixCraft' /dev/sda1 > file.txt

Next use vi to see file.txt. This method is ONLY useful if deleted file is text file. If you are using ext2 file system, try out recover command. .

See also:

🐧 Get the latest tutorials on Linux, Open Source & DevOps via RSS feed or Weekly email newsletter.

🐧 32 comments so far... add one
CategoryList of Unix and Linux commands
Disk space analyzersncdu pydf
File Managementcat
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network UtilitiesNetHogs dig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
32 comments… add one
  • sonia Oct 27, 2006 @ 11:13

    please show the whole procedure slide by slide so that layman can understand better.

  • sridhar Jan 9, 2007 @ 5:42

    the files in /var directory have gone missing in our solaris there any way we can recover it???????please help

  • 🐧 nixCraft Jan 10, 2007 @ 6:55


    There is no real undelete available (until and unless you go for 3rd party commercial software). Restore file from backup. If it is config file restore by copying 3rd system or reinstalling package.

    Appreciate your post.

  • manish Dec 13, 2007 @ 3:03

    i have removed .xsd files now i want them back.can anyone help me to get my .xsd files.

    Thanks in advance

  • Christophe GRENIER Jan 3, 2009 @ 3:28

    PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from Hard Disks and CDRom and lost pictures (thus, its ‘Photo Recovery’ name) from digital camera memory. PhotoRec ignores the filesystem and goes after the underlying data, so it will still work even if your media’s filesystem has been severely damaged or re-formatted.

    PhotoRec is free, this open source multi-platform application is distributed under GNU Public License. PhotoRec is a companion program to TestDisk, an app for recovering lost partitions on a wide variety of filesystems and making non-bootable disks bootable again. You can download them from this link.

    For more safety, PhotoRec uses read-only access to handle the drive or memory support you are about to recover lost data from. Important: As soon as a pic or file is accidentally deleted, or you discover any missing, do NOT save any more pics or files to that memory device or hard disk drive; otherwise you may overwrite your lost data. This means that even using PhotoRec, you must not choose to write the recovered files to the same partition they were stored on.
    PhotoRec runs under

    * DOS/Win9x
    * Windows NT 4/2000/XP/2003/Vista
    * Linux
    * FreeBSD, NetBSD, OpenBSD
    * Sun Solaris
    * Mac OS X

    and can be compiled on almost every Unix system.
    Photorec ignores the filesystem, this way it works even if the filesystem is severely damaged.

    It can recover lost files at least from

    * FAT,
    * NTFS,
    * EXT2/EXT3 filesystem
    * HFS+

    ReiserFS includes some special optimizations centered around tails, a name for files and end portions of files that are smaller than a filesystem block. In order to increase performance, ReiserFS is able to store files inside the b*tree leaf nodes themselves, rather than storing the data somewhere else on the disk and pointing to it. Unfortunately, PhotoRec isn’t able to deal with this, it’s why it doesn’t work well with ReiserFS.

  • Davi Feb 8, 2009 @ 2:15

    Thank you! It worked!
    It is not very clear in the instructions, but “nixCraft” is not the name of the file, is something wrote in the beginning of the file…

  • Cullen Linn May 14, 2009 @ 13:38

    Whew…that saved me some time. Very helpful, thank you!

  • hosney osman Jul 8, 2009 @ 9:47

    even i am using
    # rm -rf /export/home/john
    is there any command to recover this folder again

  • Frode Nov 16, 2009 @ 9:27

    Hi all,

    I just had to recover a file from ext3 on Ubuntu, and used the utility ext3grep to do so.

    It’s in the Ubuntu repositories, so install it before you need it:
    sudo aptitude install ext3grep

    And remember, if you are storing your backups encrypted, keep the password to the encrypted folder in a file SEPARATELY (not in the encrypted folder), so when you delete it, you can just restore it, rather than get that ‘sinking feeling’…
    I was lucky, ext3grep worked for me – I had to follow the manual recovery examples on the ext3grep homepage, the auto recovery didn’t do it for me.

    Best of luck to you!

  • mohit Dec 4, 2009 @ 19:15

    my initrd file is deleted and my pc is not boot so how can i recover..?
    please tell me m waiting for ur reply..
    plz tell me commands..

  • Soren Frank Feb 7, 2010 @ 20:12

    This saved my life. Got a very important source code file back, 100%. Would have taken me days to rewrite. Didn’t delete a file, but server/samba failed, and stored a file of size 0 on top of the file. Have seen it before. Thank you.

  • rajesh Feb 18, 2010 @ 1:02

    i am mistakely deleted bin files . how to recover the files in redhat linux

  • Vlad May 14, 2010 @ 14:39

    Thanks, it was a life saver!

  • Bizim Oyun Sitesi Jun 1, 2010 @ 11:48

    Great information about linux recovery. But I couldn’t recover one of my files from ext4 on ubuntu 10.4. Is there any reason not to work ?

    Thanks for reply.

  • g b viswanadh Dec 4, 2010 @ 13:51

    how to recover the deleted files in linux in just 3 mints back, is this possible or not,
    i think that concerened file of deleted file is to tb store in may i think some other location, i think upto system boot it will be stored in sysytem, and after deleted files where it will be goes to

  • Anantha kumar Dec 15, 2010 @ 6:57

    we have used Red hat linux5 in my company…We have used php,mysql …
    Problem is some of the .php as well as txt files are to be deleted…
    how to recover that files..any 3rd party or free tool or recovery command is there…

    pls tell me very very urgent….pls help me

  • dilip Feb 19, 2011 @ 14:47

    By mistake I have run a command in CUI mode “rm -rf * text file”…and it deleted other files..
    Don’tr know which file have been deleted
    how can I check the deleted files?
    Is there any command to recover that?
    Kindly suggest…its urgent!!

    • abc Aug 9, 2011 @ 12:37

      There is no scope of recovery of files

  • pinaki May 24, 2011 @ 16:44

    i have mistakenly ran a comment “rm *” in the directory “/cust/scripts” which was having files of “.scr” extension. now i want to retrieve all the files. is there any way to retrieve the deleted files. pls help me out…..

  • javier Oct 21, 2011 @ 15:08

    How to identify the partition in which the delete file operation occurred?
    Can it be possible to just indicate a folder in which it was deleted?

  • msrao Nov 8, 2011 @ 16:05

    using grep command, unnecessary data which matches with the given string will added in the output file. so i thing it is not good method to restore deleted files

  • klo Jan 6, 2012 @ 4:35

    Worked great for me on ext4

    thanks for the tip

  • dave Mar 15, 2012 @ 20:54


  • Juan Fernando Lopez Jun 21, 2012 @ 17:52

    Thanks! I accidentally removed a .c file. This post helps me to recover! THANK YOU VERY MUCH!!!

  • ivan Jun 21, 2012 @ 18:15

    this may be the stupidest advice ever offered for such a common occurence of recoviering an accidental deletion – whoever posted this nonsense should be ostricized as the village-idiot he or she obviously is

  • Tom F Jun 29, 2012 @ 18:58


    This process would work fine for a small file that was deleted, like someone’s homework.

    It is not a substitute for a backup and recovery plan.

    If you would like a better plan, then make one. You could also dump on a daily the fs tree with the inodes table so that if you lose a file, at least you would know what blocks contain the data segments of your file to be able to recover it easier. That type of program is way beyond the scope of a simple one liner script as this shows.

    Grow up

  • saiprakash Feb 1, 2013 @ 10:18

    Hi All,

    I am using Redhat Linux 6, getting an error when users are able to login ‘-bash: /dev/null: permission denied’. Could you please help me in resolving. Only root is able to login. Also not able to use Vi editor.

  • Rakesh Mar 1, 2014 @ 8:53

    by mistake i run the commond rm -rf * on my server and all files are deleted ,
    can you please tell me the procedure how to recover all the data it’s very urgent for me and i am not able to logged in super user mode.
    Thank you in advance.

    • Rati Apr 25, 2014 @ 8:14

      not possible

  • Shivam Mar 1, 2014 @ 8:54

    same question from my side as Rakesh discribe.
    Thank you very much

  • samba Aug 26, 2015 @ 5:45

    frist data delete in file ,next empty file also delete how recovery in redhat linux

  • Rajdeep Gupta Feb 2, 2016 @ 11:31

    I deleted a file from Linux using rm -r command. I want to recover that .please tell me how to do that

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre> for code samples. Still have questions? Post it on our forum