Have you ever lamented the absence of an UNIX “undelete” command?
Fortunately, not all hope was lost. When a file is deleted from a hard drive, the blocks are freed, but not actually cleared. The data remains on disk, but it cannot be directly accessed and is in danger of being overwritten. Recovery is a matter of search and rescue.
Load up your shell and use your old grep friend:
$ grep -a -B 25 -A 100 'some string in the file' /dev/sda1 > results.txt
Open the results.txt and will probably contain lots of gibberish, but if you’re lucky, the contents of the deleted file will be intact and recoverable.
To help prevent this problem from happening in the first place, many people elect to alias the rm command to a script which will move files to a temporary location, like a trash bin, instead of actually deleting them.
blog comments powered by Disqus