Can I recover a deleted file? [duplicate]

Solution 1:

rm versus deleting from GUI

If you used the command rm, you did indeed delete the file. The data is no longer reachable from the file system - except there was another hard link to the file (unusual), or you deleted a symbolic link.

The actual data may be still on the disk, on disk blocks the filesystem assumes to be unused. It you want to recover it, you should not write to the disk, because it could reuse the disk space holding you data. You could try regular data recovery on the file with the tools suitable for the file system you used.

For the default ext4 filesystem, see: Is there any recovery software available for ext4? and most answers on the question linked below.

Trash for the CLI

It is possible to use the trash bin from the command line, but that's not set up by default. The package trash-cli contains commandline tools to use the trash bin of your desktop environment.

There are commands like trash-put, trash-list etc;
The names are pretty long - you could define shell aliases like

alias tp='trash-put'

or

alias del='trash-put'

and then use del instead of rm to delete files or directories in a more safe way.

As it is proposed in the answer linked below, it's possible to use the alias name rm, replacing the actual rm command with trash-put, but there are multiple reasons not to do that; some of them are:

• The implementation of trash-put is much less well-tested that rm from 'GNU coreutils' in Ubuntu, for example.
• The options of the default rm are not all supported by trash-put
• Someone else will use the shell with the alias sooner or later, and will see a very broken rm command, technically.
• A special syntax is needed when the real rm is required
• Generally, it's not a good idea to mess with a very dangerous tool, at least risking confusion.

Having said that, see the answer of @enzotib on Can files/directories deleted with rm be restored? on how to configure the alias.

Solution 2:

There's a special case where you can get a deleted file back - when it's still open in some program. You just have to figure out what program is using it.

I saved this answer by Patrick from Unix and Linux Stack Exchange, but not a link to the original.

Recovering a deleted file if the file is still open in a program.

If the file is still open, you can get it back by going to /proc/PID/fd where PID is the pid of a program that has the file still open. This directory contains all the open file descriptors of the program, and you can access them just like normal files, so you could copy the file off /proc. – Patrick Dec 18 at 4:44 and – camh Dec 19 at 7:12 - Unix and Linux stackexchange