Beefy Boxes and Bandwidth Generously Provided by pair Networks
Do you know where your variables are?

Restoring deleted files under Linux

by chipmunk (Parson)
on Aug 21, 2001 at 23:27 UTC ( #106709=CUFP: print w/ replies, xml ) Need Help??

Earlier today, my officemate and I were busy working on a big project, when he suddenly slammed his hands down on his keyboard, shouted 'F***!', spun his chair around, and kicked a cardboard box into the corner of the office.

He explained that he had accidentally deleted the script that he had been working on for the past four days. (He meant to delete a similarly named file with a different extension.) Of course, he wanted to know if there was any way to recover the file.

Before I go any further, I should say that it should have been possible to recover the file from CVS or a backup, but he hadn't checked the file into CVS yet, and the file was created after the most recent back up. Additionally, he had already deleted the emacs backup file. So, in the absence of those obvious and more reliable solutions...

I did a Google search for "undelete linux". One site described an unrm utility, but the download server wasn't reachable. On another site, I found a Linux FAQ with the question How Can I Undelete Files? It suggested searching the raw disk device to find the deleted file.

So, I turned to Perl, writing two quick scripts. These are just one-offs; I was more concerned at the time with recovering the file quickly rather than coding for strictness or reusability. BTW, these have to be run as root.


The first script reads the raw bytes of the device (`df` told me the file I wanted was in a directory mounted on /dev/sda6) looking for the string 'littleWindow', the name of a subroutine from the script. It prints out the byte offset and the text every time it finds a match.

#!/usr/local/bin/perl open(DEV, '/dev/sda6') or die "Can't open: $!\n"; while (read(DEV, $buf, 4096)) { print tell(DEV), "\n", $buf, "\n" if $buf =~ /littleWindow/; }


The second script uses byte offsets from the first script (matches were found in two separate locations), and reads in a big chunk around each one. My coworker said the file was around 20K, so I subtracted 20000 from each offset and read in 40000 bytes.

#!/usr/local/bin/perl open(DEV, '/dev/sda6') or die "Can't open /dev/sda6: $!\n"; open(OUT, '>tmp1.txt') or die "Can't open tmp1.txt: $!\n"; seek(DEV, 946192864, 0) or die "Can't seek: $!\n"; read(DEV, $buf, 40000) or die "Can't read: $!\n"; print OUT "$buf\n"; open(OUT, '>tmp2.txt') or die "Can't open tmp2.txt: $!\n"; seek(DEV, 970662368, 0) or die "Can't seek: $!\n"; read(DEV, $buf, 40000) or die "Can't read: $!\n"; print OUT "$buf\n";


Then I just opened up tmp1.txt and tmp2.txt in emacs and grabbed the contents of the missing file. It turned out that the file in tmp2.txt had already been partly overwritten, but the file in tmp1.txt was intact. Yay Perl!

When a file is deleted, all references to it in the file system are removed, but the actual bytes remain on disk until the space is used for a new file. I was fortunate that the deleted file was not a very busy file system, so I had time to grab the file before it was overwritten.

This is an ugly and unreliable solution; version control systems and frequent backups are much preferable. Nonetheless, Perl got the job done, and it was a great relief to recover the file.

Comment on Restoring deleted files under Linux
Select or Download Code
Re: Restoring deleted files under Linux
by Corion (Pope) on Aug 22, 2001 at 01:55 UTC

    Just a small comment :

    To make the file recovery "even better", you might want to prevent any writing at all to disk (except swap space) while you are trying to recover the missing file(s), so I would try to buffer all files in memory until you have read everything out from the device in question (in your case, /dev/sda6. Of course, once you take this step, you will also want to consider restoring multiple files (from an erroneous rm -rf foo/ for example), and soon your short hack turns into a big fat program itself :-)

Re: Restoring deleted files under Linux
by perigeeV (Hermit) on Aug 22, 2001 at 03:53 UTC
    Cool script. For the future, the ext2 file system allows inode manipulation, and one can use debugfs(8)to locate and modify inodes directly. Here's a HOWTO, and here's a Perl script. I haven't tried the script though.
Re: Restoring deleted files under Linux
by Zaxo (Archbishop) on Aug 22, 2001 at 14:54 UTC

    Another trick to minimize the chance of overwriting the target blocks:

    $ mount /path/to/mountpoint -o remount,ro

    This makes that filesystem read only. You must either be root, or have mount privilege for that mountpoint (set up in /etc/fstab). This is difficult for a common development server, but doable for a workstation.

    After Compline,

Re: Restoring deleted files under Linux
by binner (Novice) on Aug 22, 2001 at 19:55 UTC
    From the 'promoting existing utilities' dept.

    First, I must say 'Nicely done'.

    Second, not to rain on your parade, but there is a unix utility (fairly widely available) called's saved my a** a couple times.

      In addition, a package called "The Coroner's Toolkit" contains an utility or two for doing this as well. TCT is a tool developed for doing forensics work on machines that have been cracked, written by Wietse Venema and Dan Farmer.

      It can be found here.

      Glad to see another good tool developed for this - very nice indeed.


      -><- -><- -><- -><- -><-
      All things are Perfect
          To every last Flaw
          And bound in accord
               With Eris's Law
       - HBT; The Book of Advice, 1:7
      Thanks, I'll have to look into that. This is obviously not the same recover that's installed on my desktop machine: recover (6)          - recover a NetHack game interrupted by disaster
        $ man 1 recover

        If it's installed, it should show up.

        Hah! DOS also includes a valuable tool by the name of recover.exe. Back in the days of DOS 3, trying to restore some deleted Leisure Suit Larry saved games from my 80286 PC, I had the good sense to go and use it...
        C:\>RECOVER RECOVER [drive:][path]filename C:\>RECOVER C: [much grinding, thrashing, wailing and gnashing of a 40 meg MFM drive +for a very long time] C:\>DIR ... FILE0001.REC ... FILE0002.REC ... FILE0003.REC . . . ... FILE0040.REC 40 File(s) 21,505,356 bytes 0 Dir(s) 20,102,016 bytes free C:\> [much screaming, kicking, and pounding on desk by a thirteen-year-old +kid, for a very long time]

        Oh, the memories...

        For the confused or non-amused, I lifted the following explanation:

        2. RECOVER ... The worst example of RECOVER's deadliness is when you use it on a hard drive. RECOVER sees these thin +gs called subdirectories and assumes they're all bad files. So it convert +s each of your subdirectories into a FILExxxx.REC file. Tada! Instantly every + file on your hard drive is effectively gone. Why does Microsoft keep such a + deadly program around? To prove that RECOVER.EXE should be deleted from your +hard drive, I should point out that the many disk-repair utilities in both +Central Point Software's PC-Tools and Symantec's The Norton Utilities are writ +ten specifically to recover from the RECOVER command.

                       s aamecha.s a..a\u$&owag.print
Re: Restoring deleted files under Linux
by Zecho (Hermit) on Aug 22, 2001 at 23:06 UTC
Re: Restoring deleted files under Linux
by mystik (Sexton) on Aug 23, 2001 at 05:07 UTC

    'mc', the gnu midnight commander is usually installed on most linux desktops (at least the red hat ones)

    We had someone accidentially delete *all* of our client databases. then we realized backups were bad. :( Luckly, we knew enough to stop *all* writes to the disk immidiatly, and we let midnight commander do it's trick. (It only works w/ ext2 disks though -- and it recovers by Inode number, not by filename.) We had to sort through all the files by hand to determine whether they were mysql index'es or mysql ISD files, and for which client they belonged. that was a hectic 2 day hack job ;)

Re: Restoring deleted files under Linux
by John M. Dlugosz (Monsignor) on Aug 27, 2001 at 07:07 UTC
    Re not checked into CVS (yet):

    For just such an emergency, I have automated daily backups of all my "work" stuff. Overkill, but disk space is cheap, and "just in case".

    I also published a "Cheap Mirror" utility that is a proof of concept (under Win32) for doing autobackups when a file is saved, essentially remembering multiple generations of a file.

    More musings...
    I don't like the "trash can" thing where files aren't really delted until I empty it. But, what might be worthwhile, I think, is a time-delayed delete. Move the file to a temp directory for a few minutes and then commit the deletion. That's long enough to catch such a mistake in the command-line, but stays out of the way better than a "trash can" file.

Re: Restoring deleted files under Linux
by Anonymous Monk on Jan 28, 2013 at 02:08 UTC
    11 years after the original post and you still saved my life. Such a simple idea, and worked perfectly!
      Hopefully, he'll help mine too :(
      Help me too!
Re: Restoring deleted files under Linux
by Anonymous Monk on Jul 29, 2013 at 04:30 UTC
    Thanks a lot for posting this awesomely simple explanation! It worked perfectly and helped me to restore 6 hours of work!
Re: Restoring deleted files under Linux
by Anonymous Monk on Aug 31, 2013 at 21:41 UTC
    Hi. I just wanted to thank you. I had worked on a file for 3 hours and was about to tar.gz a bunch of stuff (including the file). Long story short, I ended up "rm -rf" on the wrong things and deleted the file i just wrote. I ran your first perl script and was able to recover my file. I am so happy! Thanks!
Re: Restoring deleted files under Linux
by Anonymous Monk on Nov 06, 2013 at 19:44 UTC
    Well, I must say: 12 years after the original post and you still saved my life. Such a simple idea, and worked perfectly!
Re: Restoring deleted files under Linux
by Anonymous Monk on Nov 21, 2013 at 18:41 UTC
    You saved my bacon also - many thanks!
Re: Restoring deleted files under Linux
by Anonymous Monk on Jan 16, 2014 at 14:12 UTC
    A life-saver, this post. Thanks.
Re: Restoring deleted files under Linux
by Anonymous Monk on Jun 19, 2014 at 22:00 UTC

    Thank you for this timeless post. Still helping out...

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: CUFP [id://106709]
Approved by root
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others chanting in the Monastery: (13)
As of 2014-07-24 18:44 GMT
Find Nodes?
    Voting Booth?

    My favorite superfluous repetitious redundant duplicative phrase is:

    Results (165 votes), past polls