Undeleting Recently Deleted Files in Linux And Unix

Linux LogoWhile working on a shell script to automate backups of my web & database server, I accidentally deleted all files in my home directory on the server instead of in /srv/backup. Thankfully, being a server, nothing of value was lost…except the shell script.

Thank you people of recoverNet for your help.

First I had to find what the device name of my hard disk was.

[username]@[machinename]:~$ df -Th
Filesystem    Type    Size  Used Avail Use% Mounted on
/dev/sda2 reiserfs    746M  571M  175M  77% /
...
/dev/sda5 reiserfs     74G   55M   74G   1% /srv/mysql
/dev/sda6 reiserfs     74G   77M   74G   1% /srv/www

Then I used the command I found at recoverNet:

grep -a -B2 -A200 "apache_server_files" /dev/sda2

The text “apache_server_files” was the third line of text. I could easily re-create the previous two lines “#!/bin/bash” and “”. Besides, searching for “#!/bin/bash” resulted in an odd error message that seemed to be the result of actually trying to execute the line instead of searching for the text.

All was good, except the result junked up the console, even after logging out of the ssh session, forcing me to restart the terminal. Eventually, I figured out that dumping the result to a text file would avoid junking up the console.

grep -a -B2 -A200 "apache_server_files" /dev/sda2 > /srv/backup/dump.txt

IMPORTANT: Notice that I dumped the result into a file on a different partition. If I had not done this, I would have risked having the remains of the deleted file overwritten.

Viola! My shell script lives! However, 200 lines was a bit much, and traversing into the trailing junk text froze things up in nano. I had to scale the -A option until I found the size that fit my script, writing to a new file each time.