Since everyone once in while acccidently deletes a file, in this article we’re going to show how you can recover deleted files in Linux. Since there are different ways to delete a file there are different ways to recover it also.
Recover deleted files in Linux
Case 1 – You deleted the file using the “Del” key.
In that case, just go to the “Trash” and search for the file in order to restore it.
Case 2 – You deleted the file by using the “rm” command
In that case, things are more difficult, since if you don’t already know, Linux absolutely DELETES those files, when you use that command. So here we’ll share a tip that might be helpfull to prevent you if you do it again, and a software that maybe you would like to use in case you just do it again anyway.
Tip for not removing the file
“-i” is a switch. That switch causes a prompt to appear before you delete the file, IF you use it with “rm”. That prompt will appear if you want to copy,move or rename that file in a directory that another file with the same name already is there. So practically this prompt is a 2nd chance for you to consider if you actually want to do whatever you want to do. So in order to replace rm with an alias as mentioned before, use the following command:
This command though, will only last for the current session. In case you want it permanent you’ll have to save it to ” ~/.bashrc ” . Some linux distros use ” ~/.profile ” instead. So if you want those changes to take places immediately, source the fill from:
Steps to recover the file
In case you delete the file anyway, there is a tool that can help you. Its name is ” Foremost” and it’s a forensics tool.
In order to install it to CentOS/RHEL 7 you’ll need to enable first Repoforge:
In Debian and derivatives:
# aptitude install foremost
After installation is finnished, test it by removing an image named “nosdos.jpg” which is placed in /boot/images.
In order to recover it, use “Foremost” as shown below.
First you’ll need to spcify the underlying partition “dev/sda1” is where /boot resides in our case)
Where /home/gacanepa/rescued is a directory on a separate disk.
keep in mind that recovering files on an equivalent drive wherever the removed ones were set isn’t a wise move.
If, throughout the recovery, you occupy an equivalent disk sectors wherever the removed files accustomed be, it’s going to not be potential to recover something. to boot, it’s essential to prevent all of your activities before playacting the recovery.
After foremost has finished capital punishment, the recovered file (if recovery was possible) are going to be found within.
Original Source: http://www.tecmint.com/recover-deleted-file-in-linux