Sunday, 22 September 2013

Rescuing deleted files in Linux

It happens. You delete a file, but not to the recycle bin, and need it back - BAD. This happened to me for a source file. Here's what to do (based on this).

Drop to the Linux command line. If you're on a graphical user interface press <CTRL>+<ALT>+1 and you should be on terminal 1. Log in like you usually would. Keep in mind you'll need root privileges later on...

Tell all users you're going to single user mode:
Wait a bit and press <CTRL>+D to put in a command. Go to single user mode to prevent stuff being written to disk:
init 1
Use grep to recover your file:
grep -i -a -B20 -A100 'some text from the file' /dev/sda1 > dump.txt
The grep commands are:
  • -i : Ignore case distinctions in both the PATTERN and the input files i.e. match both uppercase and lowercase character.
  • -a : Process a binary file as if it were text
  • -B Print number lines/size of leading context before matching lines.
  • -A: Print number lines/size of trailing context after matching lines.

If you now have a file too big to edit, try copying only a few lines to another file:
head -100 dump.txt > 100lines.txt