0

Dumb Question - Can I undelete files in a directory I deleted in Unix - Centos.

Is this possible ?

user4434
  • 61
  • 3
  • 12

1 Answers1

0

You can do this with testdisk. It works for ext2 - ext4, FAT, exFAT, and NTFS in Linux. This assumes that the data hasn't been overwritten since its deletion.

First method:

yum install testdisk

Second methond:

Get it from here https://github.com/cgsecurity/testdisk and download it to and compile it from source on another drive. The reason that you might want to do this is that installing software directly to a drive can cause the deleted data to be overwritten as the system will have marked the space that it's using as no longer in use and free to be overwritten.

  • Run testdisk from the terminal or use the location to its binary that you compiled.
  • Select Create a new log file from the menu.
  • Select your drive. You may need to select sudo and enter the password first to see all of your drives if you have more than one.
  • Select the partition. It will usually select it for you and it'll either be None or Intel.
  • Select Advanced.
  • Select Undelete.

After a scan, it'll produce a list of deleted files which will be red when they appear. Use the arrow key to select the file and use the c key to copy the file. There are options for where you want to copy the file to but if it's your /home directory by default. Do this with all of the files that you want to recover.

In any event, if you've been using the system since deleting the files, it's possible that the deleted data has already been overwritten in which case there's nothing that you can do other than take it to a data recovery agency. It's for this reason that it's always important to make regular backups of important data.

Giacomo1968
  • 53,069
  • 19
  • 162
  • 212
Nasir Riley
  • 1,425
  • 1
  • 10
  • 9
  • If you have written to the directory since the original deletion of directory files, will testdisk still work ? – user4434 Sep 05 '20 at 03:26
  • @sheeple There's only one way to find out. It's possible that the data has been overwritten but you won't know until you try to recover it. – Nasir Riley Sep 05 '20 at 03:37
  • Okay, so there is no general rule. – user4434 Sep 05 '20 at 03:51
  • 1
    There is a small but not impossible chance that installing testdisk will overwrite the very structure you are trying to recover. – Tetsujin Sep 05 '20 at 07:13
  • @sheeple I've updated my answer and provided a link to the source code for `testdisk` which is better because you can compile it on a different drive, even an external one, and run it from there so that it doesn't write to the drive. – Nasir Riley Sep 05 '20 at 11:48