3

I did this on the command line (Ubuntu 12.04 , ext4)

mv some_arbit_file required_file

Is there any way I can recover required_file? I had put so much work into this. I usually backup files but I forgot this time.

Chindraba
  • 1,963
  • 1
  • 11
  • 25
Rakesh
  • 31
  • 1
  • 1
  • 3
  • I would not used the machine, and would find a good piece of software (don't know one for linux) that can recover deleted files. Your data will most probably still be there. – soandos Jul 08 '12 at 09:00

3 Answers3

6

Some people suggest

su
umount /home
grep -a -A800 -B800 'target' /dev/sda2 | strings > recovered_file

These lines assume that your file was in the /home filesystem, /home was mounted on the partition /dev/sda2, and 'target' is a key phrase that is likely to be unique to the overwritten file. The option -a handles all binary files as text documents, the options -A800 and -B800 show 800 lines after and before a match with 'target'.
The command strings extracts text files for the stream of tokens coming out of grep. If you are on a live USB, this command may not be available but you should be able to install it nonetheless from the repository.

recovered_file is likely to be large but has a chance of containing text from the overwritten file. If the overwritten file was not primarily text, this approach is not useful.

It is important to take measures to prevent the operating system making further writes to the filesystem that contains your file. A good way is to boot from a live CD/USB. If you can unmount the filesystem or remount it read-only, that is also good.

You may find it interesting to read http://carlo17.home.xs4all.nl/howto/undelete_ext3.html - though that applies more to deleted files than to overwritten ones. However if you previously edited your overwritten file, it is likeley that the editor left several deleted copies on disk as a natural part of the editing process.

XavierStuvw
  • 415
  • 1
  • 5
  • 16
RedGrittyBrick
  • 81,981
  • 20
  • 135
  • 205
  • Thank you very much for this answer. Saved my day! I somehow managed to override a .tex file with Texmaker and suddenly faced an old version from 2 days before. The described search found the complete missing text/code from a few moments ago. Thank you! – BluesSolo Sep 19 '17 at 16:39
  • 1
    Note that if you have an encrypted filesystem, you'll have to point grep to the decrypted partition, so rather than pointing it to, e.g., `/dev/sda2` you would use something like `/dev/ubuntu-vg/root`. – Joe Antognini Aug 22 '21 at 08:15
1

Stop using/dismount the corresponding partition asap.

Consider this thread where extundelete is mentioned. Also, there exist photorec, foremost, and scalpel which are very powerful file carvers that may help recovering your file (e.g. by finding older versions or backups of your file that have not been overwritten yet).

All of these tools are available in your Ubuntu apt repositories (photorec comes with the testdisk package).

Remember to save the recovery results on another partition than the one where you recover your data from.

However, if your file has indeed been overwritten (i.e. the same area of the hard disk where the old file was stored has been used to store the new file) then there is no possibility to recover the file (Note: This is only valid for hard disks - ssds store (and "overwrite") files in another way). If you are lucky then you may only be able to recover parts of the file that were not overwritten, e.g. if the new file was smaller than the old one.

Community
  • 1
speakr
  • 3,807
  • 23
  • 22
  • Note that it is possible to recover overwritten data on conventional HDD's but it cannot be done from home, it requires professional data recovery assistance (which usually costs big bucks). Success depends on how many times you overwrote it (once or twice is usually fine). – Thomas Jul 08 '12 at 09:44
  • @Thomas: your information is out of date, no-one has ever published an account of actual recovery of the prior contents of overwritten sectors. It is now generally accepted that this is infeasible for modern hard disks. See http://www.anti-forensics.com/disk-wiping-one-pass-is-enough and http://www.infosecisland.com/blogview/16130-The-Urban-Legend-of-Multipass-Hard-Disk-Overwrite.html – RedGrittyBrick Jul 08 '12 at 09:49
  • @Thomas Consider [this article](http://www.h-online.com/security/news/item/Secure-deletion-a-single-overwrite-will-do-it-739699.html) which gives a short summary why a single overwrite is enough to securely wipe your data on hard disks. – speakr Jul 08 '12 at 10:14
0

I do not think the required_file was actually overwritten by this action. It was rather "unlinked" from the corresponding inode in order to "disappear". Neither did some_arbit_file change it's location -- it was rather the "pointer" wich previously pointed to required_file which now is pointing here.

There are tools around to help you in souch cases, like e.g. Sleuthkit or Testdisk. But they require some manual work -- and it's not that easy to do if you do not know where to start. There's also a script called ext3undel which uses those tools and automates the process, or the stand-alone extundelete utility.

Whatever you try to do: not touching the affected disk partition at all improves your chances of recovering the lost file. Do all actions on another machine would be best, and mount the affected drive read-only even for recovery also betters your chances. Not having a different machine, you could try a live CD (make sure not to mount the affected disk in write mode here as well!). Even being LiveCDs, they allow installing software in memory, so you can retrieve and run any of the above mentioned tools. Have an additional medium at hand (e.g. a memory stick, SD-Card, external drive...) to store your recovered files to, and run the process -- whichever you chose -- from there.

Izzy
  • 3,665
  • 3
  • 26
  • 34