mjhjmtu

With a bit of chances, sometimes I can recover deleted files with this script or next solution in the answer :

#!/bin/bash

if [[ ! $1 ]]; then
 echo -e "Usage:nnt$0 'file name'"
 exit 1
fi

f=$(ls 2>/dev/null -l /proc/*/fd/* | fgrep "$1 (deleted" | awk 'print $9')

if [[ $f ]]; then
 echo "fd $f found..."
 cp -v "$f" "$1"
else
 echo >&2 "No fd found..."
 exit 2
fi

There's another useful trick: if you know a pattern in your deleted files, type alt+sys+resuo to reboot+remount in read-only, then with a live-cd, use grep to search in the hard-drive :

grep -a -C 500 'known pattern' /dev/sda | tee /tmp/recover

then edit /tmp/recover to keep only what were your file(s) before.

Hey, if with unix philosophy all is files, it's time to take advantage of this, no ?

What worked for me was given by arch (only applies to text files):

grep -a -C 200 -F 'Unique string in text file' /dev/sdXN

Takes a little while, but worked when I accidentally deleted some source code I hadn't commited yet!

An alternative may be using del instead of rm for deleting:

http://fex.belwue.de/fstools/del.html

del has an undelete function and works with any file system.

Of course it is not a solution if you have already deleted your files with "take no prisoners" rm :-}

Although this Question is solved and a few years old,
I want to mention the testdisk utility.

How to recover files with testdisk is explained well in this tutorial.
To recover files run testdisk /dev/sdX and select your partition table type. After this, select [ Advanced ] Filesystem Utils, then choose your partition and select [Undelete]. Now you can browse and select deleted files and copy them to another location in your filesystem.

I had the same problem last week and I tried a lot of programs, like debugfs, photorec, ext3grep and extundelete. ext3grep was the best program to recover files. The syntax is very easy:

ext3grep image.img --restore-all

or:

ext3grep /dev/sda3 --restore-all --after date -d '2015-01-01 00:00:00' '+%s' --before `date -d ‘2015-01-02 00:00:00’ ‘+%s’

This video is a mini tutorial that can help you.

connect drive through external interface

1. mount


2. umount /dev/sd*


3. extundelete --restore-all /dev/sd*


4. results go to home folder on boot drive


5. bonus points: write a GUI for this

See this link for more info: undelete a just deleted file on ext4 with extundelete.

Recovery Tools - Command Line :

• 
  testdisk (3)(5)


• 
  photorec (3)


• 
  extundelete (3)

Recovery Tools - Gui :

• 
  R-Linux (2)(5)


• 
  R-Studio (1)(5)(4)


• 
  UFS Explorer (1)(5)(4)


• 
  Recovery Explorer (1)(5)(4)

Infos :

In my personal experience i get my data back using "UFS Explorer" and photorec

(1) = Not open source, not free

(2) = Not open source, free

(3) = Open source and free

(4) = Have ntfs support

(5) = Have directory structure feature

When you delete a file, the link count in the inode table for that file is decreased by one. In Unix, when the link count drops down to 0, the data blocks for that file are marked as free and typically, references to those data blocks are lost. I just discovered from @fedorqui's comment that there may be some way to access those blocks but that is only applicable to ext3 filesystem.

One way to preserve the files will be to write a function that will allow you to move the files to a trash area (let us say $HOME/.trash) and recover the needed files from there. This function can be aliased to rm. You can schedule a cron job to delete the files that have been in the trash area for a certain number of days.

I disagree that it is impossible, just very very difficult, and neither have I ever done it off Linux:

When files are deleted, they're not actually deleted. What happens is that the space that they were on the hard-drive is sort of reset, so that if the computer tries to write data there, nothing complains. Generally, the data on your hard drive you thought you deleted can be there almost a year later. Or at least, this is my experience on a Windows machine. Whether or not it works the same way from a commandline on Linux, I'm not sure, but you'd likely need a separate Live CD to open the partition like that, and there's also no guarantee the files are still there. I've done this on windows xp several times using Zero Assumption Recovery. I'm sure there's a similar tool around if you look hard enough.

This might save the trouble for some of you.

If you ever used gedit to edit that file, by default a copy of that file will be created.

For example let's suppose we have accidentaly deleted 'myfile.txt'.

In the folder that used to contain the file you have just deleted use these commands and you'll recover the copy from there:
ls | grep 'myfile.txt~'

With a bit of luck you'll find it and then:
cp 'myfile.txt~' 'myfile.txt'

I have recovered a file just now using this method.
Best of luck!