Saturday, 30 November 2019

How to recover a removed file under Linux?


By accident, I used rm on a file I didn't want to delete. Is there a way that I can get it back under Linux?



Answer



The following are generic steps to recover text files.




  1. First use wall command to tell user that system is going down in a single user mode:


    # wall
    System is going down to .... please save your work.

    Press CTRL+D to send message.




  2. Next use init 1 command to take system to a single user mode:


    # init 1


  3. Using grep (traditional UNIX way) to recover files


    Use following grep syntax:


    grep -b 'search-text' /dev/partition > file.txt

    OR


    grep -a -B[size before] -A[size after] 'text' /dev/[your_partition] > file.txt

    Where,


    -i : Ignore case distinctions in both the PATTERN and the input files i.e. match both uppercase and lowercase character.
    -a : Process a binary file as if it were text
    -B Print number lines/size of leading context before matching lines.
    -A: Print number lines/size of trailing context after matching lines.

    To recover text file starting with "nixCraft" word on /dev/sda1 you can try following command:


    # grep -i -a -B10 -A100 'nixCraft' /dev/sda1 > file.txt


  4. Next use vi to see file.txt.


    This method is ONLY useful if deleted file is text file. If you are using ext2 file system, try out recover command.




Found at http://www.cyberciti.biz/tips/linuxunix-recover-deleted-files.html


No comments:

Post a Comment

How can I VLOOKUP in multiple Excel documents?

I am trying to VLOOKUP reference data with around 400 seperate Excel files. Is it possible to do this in a quick way rather than doing it m...