I accidentally deleted a file from my laptop. I'm using Fedora. Is it possible to recover the file?
Data Recovery – Recovering Accidentally Deleted Files
backupdata-recoveryrm
Related Solutions
MacOS is a Unix OS and rm
means "good-bye". The GUI interface allows you to move a file to the trash (which you can then recover) but that's not what you did. If you have a backup (e.g. you have Time Machine running) then you are saved.
Clarification
Strictly speaking (as @ire_and_curses points out) a rm
simply deletes the directory entry for the file while leaving the disk blocks it used, untouched. If you could quiesce the filesystem in which the file had been, there are advanced methods by which you can try to re-discover those blocks contents. There are also some recovery tools which can be purchased to recover the loss. The central issue is that nothing else re-uses any of the disk blocks represented by your file.
The MacOS also has a secure remove command (srm
) which over-writes a file before it is unlink
ed making it unrecoverable. I use the unlink
term since this is the underlying system call associated with a shell's rm
command. This sets the stage for the next part of this discussion, below.
Sidenote
[ I should hasten to add that even if you over-write a disk multiple times, there are ways to read what was written a dozen or more times before. To properly sanitize a disk for disposal really requires an acid bath, a big hammer and a shredder. ]
unlink
ing a file decrements the file's inode link-count. If this value reaches zero, the file is deleted from the filesystem directory and its disk blocks freed for re-use. This only happens when no processes have the file open. It is often confusing to administrators to find that a filesystem is utilizing very large amounts of space that can't be accounted for by the simple summation of disk blocks (with something like du
). Most often the reason is that an open file has been removed, so that it is no longer represented in its directory. The reason is that the disk blocks remain inuse until the last process using the file terminates.
Opening a file and immediately unlink
ing it is actually a common practice for creating secure, temporary files. Tools like lsof
can expose these otherwise invisible files if you look for files with a link count (NLINK) of zero.
In Unix and Linux (of which the MacOS is a branded Unix), an rm
follows the Unix philosophy of "do-it" without fanfare if it can. That is, if you have the permissions to remove a file (i.e. your directory allows writing) then rm
does just what you ask. You might like to create a shell alias rm='rm -i'
that prompts you for confirmation before performing the operation. Using the -f
switch with rm
overrides that if necessary. An aliased rm
is most useful when you do glob
removes like rm *.log
. That is, you have the option of skipping a file in the list.
No there isn't generally any log that is maintained that keeps track of what files were deleted. About the only thing I can think of outside of trying to undelete the files using something like this Q&A: undelete files from local fileserver, is you could take a look at your system's locate
command. It keeps a full list of all the files on a system, it's typically run nightly via cron, so you might find a list of the file names there, assuming you know what directories they were in.
Example
To get a list of all the files in my $HOME
directory.
$ locate /home/saml | head -5
/home/saml
/home/saml/.Fontmatrix
/home/saml/.ICEauthority
/home/saml/.Trash
/home/saml/.VirtualBox
UPDATE #1
This approach would work so long as 2 conditions are met.
- The Windows 7 partition was mounted during the window of time that the cronjob that runs the indexing of the HDD (typically this:
/etc/cron.daily/mlocate
). This task runs daily, so if the partition is mounted one day but not the next, the data for that partition will get erased. - The
mlocate
crontab entry hasn't run yet, with those files now erased.
NOTE: This option is what I would consider a last ditch effort, something before resorting to actually attempting to recover the files using one of the many undelete methods covered on Unix & Linux. You have a very small window of opportunity to get a listing of files that were on your system from the mlocate
database but have been deleted.
Best Answer
I would advise against immediately installing some utility. Basically your biggest enemy here are disk writes. You want to avoid them at all costs right now.
Your best bet is an auto-backup created by your editor--if it exists. If not, I would try the following trick using grep if you remember some unique string in your .tex file:
Replace
/dev/sda1
with the device that the file was on and replace'string'
with the unique string in your file. This could take some time. But basically, what this does is it searches for the string on the device and then returns 100 lines before and after that line and puts it infile.txt
. If you need more lines returned just adjust the-B
and-A
options as appropriate. You might get a bunch of extra garbage returned, but you should be able to get your text back.Good luck.