Linux file recovery: A close call

Thursday 14th December 2006

Linux file recovery: A close call

I've been working on a Python project and had done quite an amount of coding when I decided to rename a few files. While doing this, the most important file, the one with the most code in it, got deleted. It was on a ReiserFS partition and I couldn't recall any tool that I could use straightaway, before the data was overwritten with something else.

I got the whole file back, but it was done in a really simple way without the use of any fancy tools. I used less.

This is what I did:

  1. Opened the partition I was working on, using less: less -f /dev/sda18
  2. Searched for some of the text that I remembered was in the file
  3. Realized that there were multiple "versions" of the data from the file I deleted (wonderful how Linux filesystems work)
  4. Recalled the last few variables I added to the original code and searched for those
  5. Copy + pasted the latest text that I found, into a new file
  6. Profit:)

Amazingly, the file size, after copying and pasting, came out to be exactly the same as the original and there were no issues with the code. Thank God for less, UNIX and Linux. Will update on the Python project when it's complete.


Liked this article? Propagate it:


On 15th December 2006, at 13:33pm PKT, Waqas Toor said:

strange it didnt worked for me :( ... any ways i think i have ext3 file system and so thats why its acting different maybe ... interesting thing you did if it really work

On 15th December 2006, at 22:43pm PKT, Fawad Halim said:

Investing some time in a good source control system will make your life a lot easier. Bazaar and mercurial are pretty low maintenance (and written in python!).

On 25th January 2007, at 02:13am PKT, Mobilnik said:

Cell phones.
e e e e e e e e w

On 18th February 2007, at 04:02am PKT, Georgia Mls said:

I've just been letting s, everything happen without me lately s. I haven't gotten a, anything done lately s

On 9th March 2007, at 20:21pm PKT, Noman Khanzada said:

Nice work, keep it up

On 26th June 2007, at 16:47pm PKT, Solaris Data Recovery said:

recover unix data