Saturday, December 23, 2017

Linux: Recovering files deleted using "rm -rf"

Removed python script file by accident. Following two methods worked for me in retrieving the file.

Trick 1:
This was posted on

$grep -a -B 40 -A 80 'string_from_file' /dev/sda1 > save_here.txt

-A 100 save 80 lines after match
-B 40 save 40 lines before match
string_from_file at least one unique string you remembered from deleted file
save_here.txt    retrieved content is copied here

Trick 2:
$lsof | grep -i "/path/to/file"
progname 1234 user_name 44 8,1 43219876 432890 /path/to/file
$cp /proc/1234/fd/44 /restore/file/tothis/path

Retrieved files might have unnecessary data or few lines might be arranged in reverse order.