Have you ever accidentally deleted a file, either by pressing the wrong delete key or by misusing the rm command on the command line? If it is deleted to the recycle bin, it can be easily retrieved. However, if rm is used in the command line to delete the file, the file is completely lost and cannot be retrieved. Recovering deleted files in Linux can be a challenge, especially if the files have not been backed up or a file system snapshot has not been used. Here are some things to try!

Many Linux desktop environments (such as GNOME, KDE, etc.) automatically move deleted files to the recycle bin. You can open the recycle bin to check if the file is there and restore it.

Please handle files carefully and use data recovery tools only when you need to recover accidentally deleted files from external storage.

If you accidentally delete system files, try foremost, this is a forensics tool for this situation. Before installing foremost on CentOS/RHEL 7, you need to enable Repoforge:

# rpm-Uvhhttp://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el7.rf.x86_64.rpm

# yum install foremost

Install foremost on Debian and its derivatives:

aptitude install foremost

To test, first delete the nosdos.jpg file under /boot/images:

cd imagesrm nosdos.jpg

To recover the file, use the following command (determine the underlying partition, such as /dev/sda1) :

foremost -t jpg -i /dev/sda1 -o /home/gacanepa/rescued

Restore files will be saved in/home/gacanepa/rescued/JPG directory. Restore files on different disks to avoid overwriting original data. Before execution, stop all activities to improve recovery success.

There are some file recovery tools to try to recover deleted files, for example TestDisk is a powerful open source tool for recovering lost partitions and repairing file systems; PhotoRec is a tool specifically designed to recover file content and is part of TestDisk. Rescuer is a data recovery software that supports multiple file systems. extundelete is specifically used to recover files on ext3/ext4 file systems.

If your system has regular backups, it will be much easier to restore files. You can retrieve lost files from the backup. If the file system supports snapshots, such as Btrfs or ZFS, you can also use snapshots to recover files.

Before attempting to recover a file, it is important to check whether the file has been overwritten with new data. If the file area has been overwritten, the possibility of recovering the file is reduced.

As soon as you realize that a file has been deleted by mistake, you should stop writing to the disk as soon as possible, because new data may overwrite the space of the deleted file, making recovery more difficult.

If none of the above methods can recover the file, or if the file is very important, consider using a professional data recovery service.

When recovering files, it is best to avoid operating on the same disk to avoid overwriting lost data. The recovery success rate is affected by a variety of factors, including the file system type, the time that has elapsed since the deletion, and the writing of new data. Prevention is always easier than recovery, and regular backup of important data can effectively prevent data loss. Keep in mind that file recovery is not always successful, so regular backups are the best strategy.