{"id":12603,"date":"2019-03-28T03:28:54","date_gmt":"2019-03-28T03:28:54","guid":{"rendered":"http:\/\/www.appservgrid.com\/paw92\/?p=12603"},"modified":"2019-03-28T03:28:54","modified_gmt":"2019-03-28T03:28:54","slug":"how-to-recover-a-deleted-file-in-linux","status":"publish","type":"post","link":"https:\/\/www.appservgrid.com\/paw92\/index.php\/2019\/03\/28\/how-to-recover-a-deleted-file-in-linux\/","title":{"rendered":"How to Recover a Deleted File in Linux"},"content":{"rendered":"

Did this ever happen to you? You realized that you had mistakenly deleted a file \u2013 either through the\u00a0Del<\/strong>\u00a0key, or using\u00a0rm<\/code>\u00a0in the command line.<\/p>\n

In the first case, you can always go to the\u00a0Trash<\/strong>,\u00a0search for the file<\/a>, and restore it to its original location. But what about the second case? As I am sure you probably know, the Linux command line does not send removed files anywhere \u2013 it\u00a0REMOVES<\/strong>\u00a0them. Bum. They\u2019re gone.<\/p>\n

Suggested Read:<\/b>\u00a0How to Recover Deleted Files\/Directories Using Scalpel Tool<\/a><\/p>\n

In this article we will share a tip that may be helpful to prevent this from happening to you, and a tool that you may consider using if at any point you are careless enough to do it anyway.<\/p>\n

Create an alias to \u2018rm -i\u2019<\/h3>\n

The\u00a0-i<\/code>\u00a0switch, when used with\u00a0rm<\/strong>\u00a0(and also other\u00a0file-manipulation tools such as cp or mv<\/a>) causes a prompt to appear before removing a file.<\/p>\n

The same applies to\u00a0copying, moving, or renaming a file<\/a>\u00a0in a location where one with the same name exists already.<\/p>\n

This prompt gives you a second chance to consider if you actually want to remove the file \u2013 if you confirm the prompt, it will be gone. In that case, I\u2019m sorry but this tip will not protect you from your own carelessness.<\/p>\n

To replace\u00a0rm<\/strong>\u00a0with an alias to\u00a0'rm -i'<\/code>, do:<\/p>\n

alias rm='rm -i'\r\n<\/pre>\n
The\u00a0alias<\/strong>\u00a0command will confirm that\u00a0rm<\/strong>\u00a0is now aliased:<\/p>\n
\n
\"Add<\/a><\/p>\n
Add Alias rm Command<\/p>\n<\/div>\n
However, this will only last during the current user session in the current shell. To make the change permanent, you will have to save it to\u00a0~\/.bashrc<\/code>\u00a0(some distributions may use\u00a0~\/.profile<\/code>\u00a0instead) as shown below:<\/p>\n
\n
\"Add<\/a><\/p>\n
Add Alias Permanently in Linux<\/p>\n<\/div>\n
In order for the changes in\u00a0~\/.bashrc<\/code>\u00a0(or\u00a0~\/.profile<\/code>) to take effect immediately, source the file from the current shell:<\/p>\n
. ~\/.bashrc\r\n<\/pre>\n
\n
\"Active<\/a><\/p>\n
Active Alias in Linux<\/p>\n<\/div>\n
The forensics tool \u2013 Foremost<\/h3>\n
Hopefully, you will be careful with your files and will only need to use this tool while recovering a lost file from an external disk or USB drive.<\/p>\n
However, if you realize you accidentally removed a file in your system and are going to panic \u2013 don\u2019t. Let\u2019s take a look at foremost, a forensics tool that was designed for this kind of scenarios.<\/p>\n
To install foremost in\u00a0CentOS\/RHEL 7<\/strong>, you will need to enable\u00a0Repoforge<\/strong>\u00a0first:<\/p>\n
# rpm -Uvh http:\/\/pkgs.repoforge.org\/rpmforge-release\/rpmforge-release-0.5.3-1.el7.rf.x86_64.rpm\r\n# yum install foremost\r\n<\/pre>\n
Whereas in\u00a0Debian<\/strong>\u00a0and derivatives, just do<\/p>\n
# aptitude install foremost\r\n<\/pre>\n
Once the installation has completed, let\u2019s proceed with a simple test. We will begin by removing an image file named\u00a0nosdos.jpg<\/code>\u00a0from the\u00a0\/boot\/images<\/strong>\u00a0directory:<\/p>\n
# cd images\r\n# rm nosdos.jpg\r\n<\/pre>\n
To recover it, use foremost as follows (you\u2019ll need to identify the underlying partition first \u2013\u00a0\/dev\/sda1<\/code>\u00a0is where\u00a0\/boot<\/code>\u00a0resides in this case):<\/p>\n
# foremost -t jpg -i \/dev\/sda1 -o \/home\/gacanepa\/rescued\r\n<\/pre>\n
where\u00a0\/home\/gacanepa\/rescued<\/strong>\u00a0is a directory on a separate disk \u2013 keep in mind that recovering files on the same drive where the removed ones were located is not a wise move.<\/p>\n
If, during the recovery, you occupy the same disk sectors where the removed files used to be, it may not be possible to recover anything. Additionally, it is essential to stop all your activities before performing the recovery.<\/p>\n
After foremost has finished executing, the recovered file (if recovery was possible) will be found inside the\u00a0\/home\/gacanepa\/rescued\/jpg<\/strong>\u00a0directory.<\/p>\n
Summary<\/h5>\n
In this article we have explained how to avoid removing a file accidentally and how to attempt to recover it if such an undesired event happens. Be warned, however, that foremost can take quite a while to run depending on the size of the partition.<\/p>\n
As always, don\u2019t hesitate to let us know if you have questions or comments. Feel free to drop us a note using the form below.<\/p>\n
Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Did this ever happen to you? You realized that you had mistakenly deleted a file \u2013 either through the\u00a0Del\u00a0key, or using\u00a0rm\u00a0in the command line. In the first case, you can always go to the\u00a0Trash,\u00a0search for the file, and restore it to its original location. But what about the second case? As I am sure you … <\/p>\n
Continue reading “How to Recover a Deleted File in Linux”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-12603","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/12603","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/comments?post=12603"}],"version-history":[{"count":1,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/12603\/revisions"}],"predecessor-version":[{"id":12604,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/12603\/revisions\/12604"}],"wp:attachment":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/media?parent=12603"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/categories?post=12603"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/tags?post=12603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}