How to Recover RM Items in Linux
When you use the "rm" command to delete a file from the Linux terminal, the file does not go to your trash bin; by default, the "rm" command removes the file from your system. If you accidentally removed the wrong file or changed your mind, you can recover the file by identifying its process ID and file descriptor. However, you need to act quickly and recover the file while you are still in the same terminal session from which you removed the file.
Other People Are Reading
Instructions
-
-
1
Type "lsof | grep removedfile.ext" and press "Enter." Replace "removedfile.ext" with the actual file name and extension.
-
2
Look at the output in the terminal. The second column is the process ID, and the fourth column contains the file descriptor. The file descriptor might contain a letter. If so, ignore the letter.
-
-
3
Type "cp /proc/1111/fd/5 removedfile.copy" and press "Enter." Replace "1111" with the process ID and "5" with the file descriptor without any letters. This command creates a copy of the file you deleted with the "rm" command called "removedfile.copy." Since you have not delete the copied file, you have your file back.
-
1
Tips & Warnings
If you have already closed the terminal session in which you used the "rm" command, you may still be able to recover the file with extra packages. Different packages work better on different distributions, so look for one for your Linux distribution.
If the sector on your hard drive that contain the removed file has been overwritten with other data, you will not be able to recover the file.
