How to Undelete Linux Recovery

Users familiar with the Windows operating system are used to having a method in which they can undelete files easily. However, the Linux operating system does not save your deleted files. Once you delete them, they are gone. If you accidentally delete a file, it may be possible to recover it, but it must be done before the program that was using it is shut down. Once the program is terminated, the file will be permanently deleted.

Things You'll Need

• Pencil or pen
• Paper

Instructions

1. Open a new terminal. Type "$ lsof | grep [deleted file name]." This will return information regarding where a copy of the deleted file is stored within the "/proc" directory.

2. Take note of the numbers in the second and fourth columns. The second column will contain a four digit number, and the fourth column will be a single digit and a letter. Write these numbers down.

3. Type "$ cp /proc/num1/fd/num2 [lost file name]" at the command prompt. Replace "num1" and "num2" with the numbers from the previous step. This command will copy the file from the "/proc" directory. The "lost file name" will be the name of the new saved file. For example, if the numbers you wrote down in the previous step were "4834" and "5g," you would enter "$ cp /proc/4834/fd/5g [newFile]."

References

• Linux: Bring Back Deleted Files with lsof