Today's Question:  What does your personal desk look like?        GIVE A SHOUT

A possible way to recover deleted files on Linux

  sonic0002        2013-11-26 07:03:37       55,282        0    

Last week I was generating a MD5 sum for an virtual machine image on one OpenNebula server:

# ls -l test.img
-rw-r--r-- 1 root root 10486808576 Oct 12 02:21 test.img

# md5sum test.img

At the same time I was clearing the files on the server on another terminal and deleted the above image file mistakenly with :

# rm test.img

Since this image file is 10GB, it took some time to remove this file from the server, so I used the Ctrl+Z command to suspend the remove command.

[1]+  Stopped                 md5sum test.img

By doing this, we can recover the deleted image file later. The rationale here is if other programs are accessing the file, the OS will not delete the file indeed(even you execute the rm command). So if we suspend the md5sum command before the completion of rm command, then the test.img file will be held by md5sum and will not be removed by rm command.

We can execute jobs to see the md5sum process:

# jobs -l
[1]+ 30888 Stopped                 md5sum test.img

# ls -l /proc/30888/fd
total 0
lrwx------ 1 root root 64 Oct 22 04:04 0 -> /dev/pts/3
lrwx------ 1 root root 64 Oct 22 04:04 1 -> /dev/pts/3
lrwx------ 1 root root 64 Oct 22 04:04 2 -> /dev/pts/3
lr-x------ 1 root root 64 Oct 22 04:04 3 -> /root/test.img (deleted)

Now we can use cp command to recover the file:

# cp /proc/30888/fd/3 save.img
# ls -l save.img
-rw-r--r-- 1 root root 10486808576 Oct 22 06:11 save.img

If you mistakenly delete text files, you can try to use grep command to recover deleted files; if you mistakenly delete exe/doc/png/jpg/gif files, you can use third party ext2/ext3 file recovery tools such as TestDisk, PhotoRec to recover deleted files.

Source : http://www.vpsee.com/2013/10/how-to-recover-a-large-deleted-file/

LINUX  FILE  RECOVERY 

Share on Facebook  Share on Twitter  Share on Weibo  Share on Reddit 

  RELATED


  0 COMMENT


No comment for this article.