How to Recover Files Deleted by RM Commands

The RM command in the Linux operating system is used to delete a file from the hard drive. When you have accidentally executed the command on one or more files you need, you must take rapid action to recover them from the drive. Accomplish this by using the file manipulation techniques in your version of the Linux operating system.

Instructions

1. Log in to the "root" (administrator) account.

2. Type "mount | column -t" (without quotes) and press "Enter." Look through the readout for the device on which your file was stored and the file system used on that storage device (e.g., ext2, vfat).

3. Type "grep -a -B[size before] -A[size after] 'text' /dev/[your_partition]" and press "Enter." Replace "[size before]" with the disk space used prior to the deletion, "[size after]" with the number of lines in the deleted file, "'text'" with the initial characters of the file, and "[your_partition]" with the partition upon which the file was stored. For example, to undelete a file of 400 lines from the "hda1" partition that contained the phrase "helloworld," you would type "grep -a -B2 -A400 "helloworld" /dev//dev/hda1."

References

• Admin Linux: Recover from RM