Retrieve files deleted by command rm in terminal [duplicate]
To this end I use trash-cli package and the following alias in my ~/.bashrc
alias rm=trash
And the trash-cli package can be installed by the followoing command: sudo apt-get install trash-cli.
The files you remove will be moved to trash, and you can see them in nautilus trashcan.
You can always access the real rm by using one of the following method:
command rm something
'rm' something
\rm something
There are also commands to access the trashcan from terminal, trash-list, restore-trash (or trash-restore), trash-empty installable from package trash-cli (then see their man pages).
Last note, it is not advisable to use such an alias for super-user, because it can interfere with system operations.
Deleting it from terminal deletes it permanently - recovery is very hard and sometimes impossible.
If your partition type is ext3 (check it by using the System->Administration->Disk Utility), then take a look at ext3undel.
If it is not (if you installed Ubuntu with default settings), try the extundelete program.
There is no guarantee you will recover anything though.
You are looking for: extundelete - utility to recover deleted files from ext3/ext4 partition
To find such a package, you can try: apt-cache search undelete
To use the utility install it with: sudo apt-get install extundelete
After installation invoke man extundelete and study it carefully.
Just as an alternative, if you know specifically what type of file it is...
sudo apt-get install foremost
Now open up /etc/foremost.conf and you will see a long list of commented out lines. If your file type exists, uncomment the line (you may also want to remove the irrelevant lines).
If your file type does not exist, add your own line. Say I want to recover a .css file and I know its around 40K. I could do add this:
css n 40000 Theme\sName: Plugin\sFixes
The 2nd column refers to case-sensitivity, the third column refers to the upper limit for size, the 4th column is how the file starts (remember to use escaped characters) and the last column is how the file usually ends.
Use the following command (edit the disk accordingly. could check with df command)
foremost -v -T -c /etc/foremost.conf -i /dev/sda -o output
What will happen next is that foremost will create a folder called output and dump all the recovered data (in this case) into the folder. From there you could use diff or meld to compare the recovered 'files' and see which is the most up to date.