Learning never exhausts the mind
Home >  Technology > Linux > Basic Data Recovery in Linux

Published 15th June 2012 by

Argh! Too busy on doing 6 things at the same time and during a slight loss of concentration I've deleted files which I need! What do I do? How do I get them back? How do I undelete files in Linux?
Introduction to Linux Series
  1. Installing Linux Step by Step
  2. Linux Tips for Beginners
  3. Beginners guide to Reading and Finding Files in Linux
  4. Using Grep to Search for Text in Linux
  5. Understanding Linux File Permissions
  6. How to Archive, Compress and Extract files in Linux
  7. Linux Piping and Redirection
  8. Linux Hardlinks and Softlinks
  9. How to Create and Use Bash Scripts
  10. Basic Data Recovery in Linux
  11. Apache Administration on Linux
  12. MySql Administration on Linux
  13. Switching from Windows to Linux

The first thing to do is "Don't Panic!" You can recover lost files and perform basic data recovery in Linux with ease following these instructions.

Most, if not all, filesystems will only delete the reference to the file from the partition table. This means that the data is still available but the link to it has gone and that it is possible to easily undelete files. It is very important that you do not write any more information to the drive the files were on as the new data could overwrite the file you want to recover, making the data recovery process much more difficult.

If the files to undelete are on your boot drive then you should remove the hard drive and access it from another PC. If it isn't possible to do this then you should be very careful and do not install any software or download any files to it. Try and get hold of a data recovery CD or Live CD and boot from that instead.

Fortunately this time the files I deleted were on a secondary partition, not the boot partition. Rather than remove the drive, I was able to remount it read-only.

sudo mount -o remount,ro /mystorage/

The Linux partition is now mounted read-only so the data should be "safe".

Next, create a directory on another drive which will hold the recovered files.

sudo mkdir /mystorage2/recovery
cd /mystorage2/recovery

I'm going to be using ext undelete for this as the files were on an EXT4 filesystem. If ext undelete is not installed you can (under Ubuntu) run the following command to install it. Other distributions may have slightly different commands.

sudo apt-get install extundelete

Once it has been installed, you can run the command to recover all files to the current directory.

sudo extundelete /dev/dm-4 --restore-all

Where /dev/dm-4 is the partition device.

After about 5 minutes, but depending on the size and quantity of data, any files that can be recovered will restore to the local path. You can now remount the filesystem read-write and save the files back to their original directory.

Slap yourself on the wrist and don't do it again!

Update: If you are using Samba shares and accidentally delete a file, you may be interested in enabling a Samba module which adds Recycle Bin functionality for Samba Shares rather than deleting them.

Tutorial Series

This post is part of the series Introduction to Linux. Use the links below to advance to the next tutorial in the couse, or go back and see the previous in the tutorial series.

Leave a Reply

Fields marked with * are mandatory.

We respect your privacy, and will not make your email public. Hashed email address may be checked against Gravatar service to retrieve avatars. This site uses Akismet to reduce spam. Learn how your comment data is processed.