Open In App

How to Recover a Deleted File in Linux?

Last Updated : 06 Apr, 2021
Like Article

We all have often faced a problem where we have accidentally deleted some files in Linux, that we definitely regretted deleting off later on after we did not even found it in the trash. But what if we can recover them? In this article, we will discuss How we can recover a Deleted File in Linux.

Whenever we delete something from our system, it does not actually get deleted, till that space gets overwritten by something else in the disk. You can also read about how to securely delete any files permanently.

The best way to Recover a Deleted File in Linux is as follows:

1. Unmounting:

Unmounting a device immediately after we realize we’ve deleted important files is the best option to prevent the data blocks of the deleted files from being overwritten with other data. 

  • At 1st Shut down the system, and do the recovery process by booting from a Live CD/USB
  • Search the partition that contains the file you deleted, for example- /dev/sda1
  • Recover the file (make sure you have enough space)

2. lsof command:

Sometimes an open file is deleted accidentally, in that case, lsof command is a life-saving command to recover that file.

A copy of the file is recreated with the help of lsof command before the file is being closed by the application holding it open. This happens because the inode is still active, so the data blocks are still on the disk until the application holding it open closes it. 

Step 1: Make a test file inside the /tmp directory

touch /tmp/test 

How to Recover a Deleted File in Linux

Step 2: Run something that will hold the file open:

 tail -f /tmp/test & 

How to Recover a Deleted File in Linux

Note: Here the number is 8561 but in your case, it might be different so use the commands accordingly.


Step 3: List the process for confirming the open process

ps -ef | grep 8561 | grep -v grep  

How to Recover a Deleted File in Linux

Step 4: Manually just delete the file and try listing  the file, you will be shown an error message because it has been deleted

$ rm /tmp/test    
$ ls -l /tmp/test    

How to Recover a Deleted File in Linux

So now we are sure that the file is actually deleted, lets now try to recover it with the help of lsof command 

Step 5: For displaying the open file descriptor of the process use lsof command

$lsof | grep -i test 

How to Recover a Deleted File in Linux

The PID of the process that is holding that file open is displayed in the second column.

Step 6: Now we have to locate the open file descriptor in /proc directory

$ls -l /proc/8561/fd/3 

How to Recover a Deleted File in Linux

Step 7: Now the open file (that was deleted but opened by some other process) can be copied back to its original location i.e., under /tmp. After that, you can also rename it by its original name

$ cp /proc/8561/fd/3 /tmp/                                                         
$mv /tmp/3 /tmp/test 
$ ls -l /tmp/test 

How to Recover a Deleted File in Linux

Now you are done recovering the file, that you thought to be lost forever.

3. Foremost (forensics tool):

Foremost is a forensic tool that comes more or less pre-installed in kali Linux but if it is not there, you can install it from the command line. The foremost tool is used to recover deleted files from hard disk, memory card, pen drive, etc.

This tool uses a process called File Carving for recovering data.

How to Recover a Deleted File in Linux

For recovering a deleted image use the following command:

sudo foremost -v -q -t png -i /dev/sda1 -o ~/test

How to Recover a Deleted File in Linux

Where /dev/sda1 is the underlying partition where /boot resides.

where /home/tithi/Downloads/gg is a directory on a separate disk where the recovered file will be located(don’t recover the files on the same drive where the removed ones were located, it might fail to recover anything). A lot of files will be get recovered together and the recovered name file won’t be similar to the original one.

Similar Reads

How to Recover Deleted Files Using Foremost in Linux?
Foremost is a digital forensic application that is used to recover lost or deleted files. Foremost can recover the files for hard disk, memory card, pen drive, and another mode of memory devices easily. It can also work on the image files that are being generated by any other Application. It is a free command-line tool that is pre-installed in Kali
3 min read
PhotoRec Recover Deleted or Lost Files in Linux
It is quite a common requirement for users wanting to access the files that they have deleted in the past. This is partly due to misjudgment of the importance of the file, deletion of the file by malicious software, or loss of file due to a File system corruption. Whatever the reason may be, sometimes one just could not prevent their files from get
4 min read
How To Recover Deleted Google Docs Files
Sometimes, we accidentally delete important stuff, like a Google Docs file. Losing a Google Docs file is like misplacing a paper document, it can be frustrating when the Google Docs File is needed immediately. But the cool thing about digital stuff is we can often get it back. In this article, we'll walk through the steps to recover your deleted Go
6 min read
Zydra - Recover Password Protected PDF, ZIP, and RAR
If you have lost your password of any zip, pdf, rar file, then here is an interesting tool for recovering passwords of the pdf file, zip, rar files. We use to save our crucial data in PDF, ZIP, RAR files as in encrypted format, but sometimes we forget the password and lost our data. Password encryption provides extra security for our files and data
3 min read
How To Recover Resolved Comments In Google Docs
You can bring back old comments in Google Docs super easily! Google Docs is awesome for working together, but what if you want to check out old comments? No worries! You can totally do it. Don't miss any cool ideas. Follow these steps to bring back old comments and make your document even cooler. Let's do it! In this post, we will learn how you can
6 min read
How to Fix - Cp: Cannot Create Regular File 'File': File Exists
In Linux, while performing copying operations using the cp command, the error "Cp: Cannot Create Regular File 'File': File Exists" may occur when attempting to copy a file to a destination where a file with the same name already exists. This error is a safeguard to prevent accidental overwriting of files and potential data loss. To resolve this iss
4 min read
Difference Between Arch Linux and Kali Linux
Arch Linux is an open-source Linux-based Operating System that is freely available for use. It belongs to the Pacman-based Linux family. It is a light weighted OS for daily use and could even be used by professionals. It was first released in March 2002. It is a beginner-friendly Linux Operating System. Features of Arch Linux: Minimalist approach:
4 min read
Neofetch In Linux – Snap cool screenshots of your Linux
Neofetch is a fancy, highly customizable, and aesthetic command-line system information screenshot utility tool. Written in the Bash scripting language, it works inside a terminal window, on triggering up the command it by default displays the operating system, software, and hardware of your system on the right side of the column alongside an ASCII
4 min read
Exodus - Copy Linux Binaries From One Linux System
Exodus is an easy-to-implement program, that is used for bundling dependencies, and also helps to effectively copy Linux ELF binaries from one to another machine securely, and this is very handy when you don't have root access, also if there are issues in the availability of the packages in the Linux distribution, Commonly Server oriented distribut
4 min read
Basic CentOS Linux Commands in linux
CentOS is a free and open-source operating system that aims to provide a stable reliable, and community-supported platform for servers and other enterprise applications. In this article, we will be covering CentOS Linux basics commands and functions of CentOS and also we will look into the advanced commands. These CentOS commands allow you to manag
4 min read
Article Tags :