29

Can we undo operations done in a terminal, for example, file deletion through rm?

Solutions obtained:

  1. Aliasing
  2. Undelete utilities
  3. Backup utilities
  4. LibTrash
  5. Versioning (FUSE)
Community
  • 1
cdb
  • 1,059
  • 3
  • 18
  • 25
  • 1
    On `rm`: It *unlinks* a file from it's `inode`. The question: "Where do files go when the `rm`command is issued" -> http://unix.stackexchange.com/questions/10883/where-do-files-go-when-the-rm-command-is-issued might also be a good read for you. – erch Dec 08 '13 at 15:52
  • You can consider [foremost](https://www.geeksforgeeks.org/how-to-recover-deleted-files-using-foremost-in-linux/). I also think, that the solutions obtained section (if it belongs there) should be updated. Should I add references to the respective answers? – Cadoiz Oct 06 '22 at 11:35

13 Answers13

70

There is no general "undo" for every operation in terminal.  If you wish to recover a file after using rm you will need to look into recovery software.

An option to prevent you from future mistakes is to make aliases for alternative commands to remove files.  Add them to your ~/.bashrc and get into the habit of using them instead of rm.

  1. alias rmi='rm -i'

    If you use rmi, you will be prompted for confirmation of future deletes.  Try to avoid developing the habit of pressing y immediately after you issue an rmi command, as that will defeat the purpose.

  2. You could also move files deleted by the trsh command in terminal to your recycle bin (on KDE and Gnome):

    alias trsh='mv --target-directory="$HOME/.Trash"'

    If you use trsh, you will have a limited "undelete" capability.  Beware that

    trsh dir1/file1 dir2/file1

    may still cause unrecoverable data loss.

G-Man Says 'Reinstate Monica'
  • 7,678
  • 22
  • 41
  • 87
John T
  • 163,373
  • 27
  • 341
  • 348
  • 9
    the second alias is very, very smart. +1. – LiraNuna Aug 28 '09 at 07:58
  • How do you do this on a Mac? ~./Trash is the trash, but mv doesn't have the target-directory switch... – Rich Bradshaw Aug 28 '09 at 11:02
  • 1
    @Rich: you can define a function: rm() { rm $* ~/.Trash } – mouviciel Aug 28 '09 at 12:29
  • 3
    trash() { mv $@ ~/.Trash; } # bash function, not an alias. Changing the expected behavior of rm is a bad idea, IMHO. – Richard Hoskins Aug 28 '09 at 12:43
  • Yeah, I wouldn't have overloaded rm - I guess this doesn't support -r or -f flags, so it's not identical. – Rich Bradshaw Aug 29 '09 at 08:37
  • 21
    The risk with aliasing `rm` to `rm -i` is that you get used to the safety net that it gives you. Then you go onto another machine, which doesn't have that alias... – Dentrasi Aug 29 '09 at 09:35
  • 3
    For the reasons that Richard and Dentrasi mention, I prefer to create a custom function or to alias `rmi` -> `rm -i`. It's really a mistake to simply get in the way of an existing program by aliasing over it. – Telemachus Aug 31 '09 at 02:15
  • 1
    I'd not recommend aliasing `rm` as a safe or good solution, especially not the alias to `mv`. It just promotes false security. What do you think happens when you delete `file1` in `dir1` and then `file1` in `dir2`? It also wouldn't work for people (or scripts) like me who're habituated to run `\command` instead of `command`. You should recommend explicitly using a command like `trsh`/`trash` instead or `rm` if undelete facility is required. –  Aug 31 '09 at 09:31
  • 2
    People seem to be a little flustered over the aliasing issue. When I use another persons system the first thing on my mind is that all my little programs and shortcuts are gone, so it isn't really an issue for me. But I will edit. – John T Aug 31 '09 at 16:07
  • 1
    @John: not a huge deal, but saying we're "flustered" makes us sound like lost tourists. We disagree with your original method, and we gave reasons why. There's no fluster. (That said, I removed my downvote, since you switched to rmi. Thanks for seriously considering the comments.) – Telemachus Aug 31 '09 at 19:59
  • @John: Thanks for the edit. It'll hopefully nudge folks in the right direction. +1 from me. –  Aug 31 '09 at 23:43
  • 1
    I wouldn't recommend `rm -i` either, not because of other systems, but simply because it trains you to hit `y` really quickly after you called `rm`. Thus it provides no extra safety, as most of the time you will only realize the second after you hit `y` that this wasn't such a good idea. – Grumbel Sep 09 '09 at 16:00
  • i am with grumbel here: avoid the alias 'rm -i' because you quickly will develop the habit of pressing 'y' .. just automatically. the trash() function is much smarter. i have my /tmp mounted as tmpfs (ramdrive) .. so i point my trash() towards /temp. if i made a mistake, i recover it .. if not, the next reboot will wipe it all away. there is a size-limit for what fits into that 'trahs' obiously :) – akira Sep 24 '09 at 19:43
  • 1
    I always have rm, mv, and cp aliased to add -i. It's most useful for mv and cp, because you usually don't mean to clobber anything with them. Never get in the habit of running rm * and then answering yes/no. As others have said, some day that safety net won't be there and you'll regret it. – Peter Cordes Dec 12 '09 at 04:22
8

You could use trash-cli if you use KDE when you run a gui. This is command line utility to delete/restore using the KDE trash facilities.

joe
  • 121
  • 1
  • 1
    trash-cli provides also works with GNOME trash and it's designed to provide rm options compatibility (for the aliasing). – Andrea Francia Dec 02 '09 at 08:04
  • Don't forget to `alias rm=trash` so that your typical command-line screw-ups come with undo buttons. – Ryan C. Thompson Feb 19 '10 at 23:25
  • 2
    I think `alias rm=trash` is potentially dangerous, if there is any chance you will use someone else's system one day and forget (or ssh). Much safer to just get used to writing `trash` instead of `rm`. – Sparhawk Feb 28 '14 at 04:20
  • As [Andrea Francia said](https://superuser.com/questions/31171/undo-the-linux-trash-command#comment79670_31879), `trash-cli` will also work with GNOME and from my experience perhaps other DE. This is also true for [trashy](https://github.com/oberblastmeister/trashy), which would also be a good alternative :) – Cadoiz Oct 06 '22 at 11:18
6

There is no recycle bin for the command line.

You could try some of the various undelete utilities, but there's no guarantee that they would work.

The How-To Geek
  • 6,042
  • 8
  • 44
  • 47
6

Two more technical solutions have not be named yet:

  1. libtrash: A dynamic library which can be preloaded in your shell which intercepts the deleting/removing syscalls and moves the files to a trash folder instead (much like an alias but works for any application when preloaded).
  2. A versioning file system. If you delete (or edit, or copy, or ...) a file, you can just revert to an old state. This could be done with a FUSE filesystem and one of its versioning filesystems.
joschi
  • 1,131
  • 6
  • 5
4

You could make rm an alias for the trash command (You will need to install trash first.) Add this to your ~/.bashrc :

alias rm='trash'

This is preferable to alias rm='mv --target-directory=$HOME/.Trash' since ~/.Trash is NOT the trash folder for gnome. It is better IMHO to let trash figure out where the actual trash folder is.

btw I would have posted this in a comment but I don't have enough rep.

Alvin Row
  • 603
  • 6
  • 10
3

There's a larger question here that's worth addressing. Shell commands are not chatty (they don't double check what you want), and they expect you to know what you're doing. This is fundamental to how they are designed. It's a feature, not a bug.

Some people feel macho when they use such commands, which I think is pretty silly, but it is important to understand the dangers. You can do a great deal of damage in a terminal, even if you're not root. I think you probably really just cared about rm, but since you said "Can we undo the the operations done in terminal", I thought this was worth saying. The general answer is no, you can't.

Telemachus
  • 6,845
  • 1
  • 27
  • 33
2

Option 1: See Undelete Linux Files from an ext2 File System. This page points to a program, written by Sebastian Hetze of the LunetIX company, that (as the title suggests) undeletes recently deleted files from an ext2 filesystem. Example usage:

# undelete -d /dev/hdc3 -a 10

Warnings:

  • The original web site is gone. The link, above, is to the Internet Archive.
  • The site(s) are in a mixture of English and German.
  • As stated above, the tool is designed specifically for the ext2 filesystem. It is unlikely to work on any other filesystem type; especially not ones other than extN.

Option 2: I have rsnapshot (rsync) running on my machine which makes snapshots hourly of my selected folders. It incrementally does this every hour, 2 hours or whatever you tell CRON to do. After a full day it recycles these snapshots into one daily snapshot and after 7 days in a weekly so on and so on. This makes me able to go back in time for about a month or so for every hour! It is pretty good with disk space as it creates symbolic links to files which never changed...

G-Man Says 'Reinstate Monica'
  • 7,678
  • 22
  • 41
  • 87
Pit
  • 892
  • 5
  • 7
  • Just to clarify, #1 is specific to ext2 filesystems. It wouldn't work on an ext3 filesystem. –  Aug 31 '09 at 09:35
2

Recover using grep on /dev/partition (Linux or Unix Recover deleted files – undelete files),

grep -b 'search-text' /dev/partition > file.txt

Just a try.

Peter Mortensen
  • 12,090
  • 23
  • 70
  • 90
cdb
  • 1,059
  • 3
  • 18
  • 25
1

There exist undelete utilities for ext2, but most other Linux filesystems are stuck in the Stone Age and don't have any advanced usability features. Sad state of affairs considering gigantic drives with enough space to never delete a file again are commonplace.

So you are stuck with three options:

  1. Do backup regularly, for example with a command like:

    rsync -axvRP --backup --backupdir=/backup/incr/$(date -I) /home/ /backup/root/

  2. Use a version control tool such as git for all your work. While this will not protect against against a crazy rm -r that kills the repository, it will protect against regular troubles as you will be using git rm not raw rm.

  3. Be extra careful and don't trust too much in rm -i, trash-cli and friends, as most data you will lose on the shell you will not lose by accidental rm, but by misdirected pipes, mistyped output files, misdirected mv and stuff, i.e., things that will overwrite your data, not just delete it.

Do all three for maximum amount of safety.

Community
  • 1
Grumbel
  • 3,542
  • 6
  • 31
  • 35
  • It's pretty hilarious to call ext2 modern. The newer filesystems use more complicated on-disk formats than ext2/3, and had to give up easy-to-find locations where you might find files to un-delete. They're designed for people who make backups of things they care about. BTW, I always use mv and cp -i, since I don't normally want to clobber anything. I normally type \rm, because I have rm aliased to rm -i, too, but I don't want to answer its question. – Peter Cordes Dec 12 '09 at 04:19
1

TestDisk can undelete files from FAT, exFAT, NTFS and ext2 filesystems.

Cristian Ciupitu
  • 5,513
  • 2
  • 37
  • 47
0

For me (opensuse leap 42.2, NTFS pendrive) PhotoRec - also by testdisk creators - worked :) However it haven't recover file names.

PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file system has been severely damaged or reformatted.

I've installed it using standard repositories in openSUSE

instruction

boczniak767
  • 103
  • 3
  • 1
    Welcome to Super User! Please read [How to recommend software](https://meta.superuser.com/questions/5329/how-do-i-recommend-software-in-my-answers/5330#5330) for **minimum required information** and suggestions on how to recommend software on Super User. To keep your answer useful even if the provided link(s) breaks these details should be edited into your answer. – I say Reinstate Monica May 02 '17 at 13:01
0

In the end, there has to be a command to ultimately delete a file. rm is that command!

If you want to do something else, I don't recommend aliasing rm itself, but changing your habits. Aliasing rm can have unforeseen side effects in scripts etc. But the worst side effect is probably that you condition yourself in using rm casually because you're getting used to that it can be undone, or that you get a confirmation only to realize that this didn't happen when you work on a different system!

Among the habits you can acquire, I'd put this on the list:

  • Use a version control system for your important work! (Not only helpful to "undo" deletes, but edits in general)
  • Do regular backups
  • Install and use a different command (e.g. trash)

And of course, always think twice before actually doing an rm.

David Ongaro
  • 346
  • 2
  • 6
0

This github project might be helpful. Suppose you did that

rm very_important_file

from the terminal. Recovering this file is a tedious and not always successful process.

Instead, if you had previously used the script mentioned up, you wouldn't have to worry about this because

rm very_important_file
mv very_important_file ~/.Trash/

are equivalent. The script handles more cases and doesn't alter your system rm at all, it's put into the user local bin folder and shadows the system rm yet without affecting or disabling it.

So you can consider this a refined aliasing approach but without losing any features.

Cadoiz
  • 519
  • 3
  • 10
a14m
  • 119
  • 4