Wednesday, February 11, 2009

How to undelete text files on linux

Today was a hard day. Someone accidentally deleted a bunch of files with code containing the last two days' work.

Fortunately, all the files were successfully recovered. I'll share the way that worked here with you.

First of all, the moment you lose your text data, make sure that if you can, you unmount the drive the files were on, so you won't overwrite the lost data.

Then you will have to run a utility called strings. Basically what it does is extracting all string data from it's input, and outputs it to STDOUT or whatever output you specify.

We will tell it to read our partition on the hard drive the lost files were. (Learn more about Linux partitions) and output it to a file on another partition.

So the command should look something like this:
strings /dev/sda1 > /some/path/for/output.txt

Note that '/dev/sda1' should be replaced by your partition path, and you should provide a path to where you want the output file to be. (NOTE: AVOID WRITING IT TO THE SAME PARTITION AT ANY COST. THE RESULTING FILE WILL BE HUGE, MORE THAN 10GB, AND YOU DON'T WANT TO OVERWRITE YOUR PRECIOUS DATA!).

After the process finishes (takes quite a while), you should have a HUGE text file that contains ALL of the text from your hard drive, deleted or not.

Now, basically all you need to do is to grep and locate the text you lost inside the whole mass.

Hope it helps you! It sure helped me!


Anonymous said...

Maybe try ext3grep next time:

Anonymous said...

if you have your files hosted on a samba server you can also use vfs recycle

Anonymous said...

Get to know PhotoRec

Anonymous said...

Thank you for information ill defiantly bookmark your blog

Danny.P said...

silfreed - Thanks for the suggestion. Looks great. I'll definitely check it out next time I'll have a situation like this!

dan said...

You have a good blog.

Rachat de credit said...

It has been a great help, many thanks, now to undelete text files on linux is simple with your advice. Thank you