Score:0

Ubuntu

Is it possible to recover a deleted directory?

sarp

1/4/24, 11:25 AM

I deleted a directory using the command rm -drf file_dev as root. Is it possible to recover this directory with its content somehow?

333

1 + 2

command-line

root

data-recovery

guiverc

1/4/24, 11:30 AM

It'll depend on what *file-system* is in use (is it one where *snapshots* are created & can be recovered?), or what backups you have.

Rishon JR

1/4/24, 11:37 AM

It is not recoverable unless u had a backup **or** @guiverc 's option.

Score:0

Ubuntu

sean

1/4/24, 11:51 AM

Install testdisk, thank me later. Works about 99% of the time.The time that it didn't is when you got unlucky and the ftrim ran on your SSD/NVME. Just keep this program installed on your machine. It fixes everything. I've wiped out whole raids and popped them back in seconds. :D

All you have to do is:

sudo apt install testdisk
sudo testdisk

As long as you know what partition it was on your chances of getting it back are pretty high. If it's on an encrypted partition you have to do this after the drive gets unlocked, if it's not it's no matter then probably the best way to run it is to boot a Live Ubuntu image, install it from the Ubuntu repository and then run it from there.

+ 9

guiverc

1/4/24, 11:59 AM

I'd suggest avoiding making any changes on the drive containing the data to be recovered... ie. your suggestion to `sudo apt install` may involve writing new data to the drive, which could overwrite inodes & thus potentially losing data. I'd use another system (even *live* as you do suggest) instead of doing anything using the current system with the drives mounted RW (*thus changeable*)

sean

1/4/24, 12:07 PM

@guiverc There is a good possibility that is already the case. It's very likely that the first thing that is overwritten is the last thing that was deleted. That's true on any filesystem. testdisk is, however, very small. You can do this all from a live cd with extra work. Install cryptsetup if it just doesn't work automatically, install testdisk, mount the partition. ETC

guiverc

1/4/24, 12:11 PM

I have no issue with the use of `testdisk`, but I'd boot another system & install `testdisk` there (and add the drive to that system for recovery of data), OR run it *live*... Either way my point was to avoid writing/changing anything on the drive which contains the *lost data* so as to increase the chance of getting data back.

sarp

1/4/24, 12:14 PM

I am taking a system Adm course on Udemy and one of my homework was moving a directory into /tmp directory and then delete it from there. The next assignmet is going back to the original directory but since I moved and not copied it the original is also gone. So it isn't really a big deal. I just asked to learn if there was a way or not. Thank you both of you for your answers.

sean

1/4/24, 12:14 PM

@guiverc no argument from me, personally I just keep the program installed at all times because you never know. Better to have it there before you need it. But, honestly, Ubuntu is writing so many little files all the time every second you've waited is a great deal of percentage less chance of success. The worst offender is the browser cache which is literally insane about this.

sean

1/4/24, 12:15 PM

@sarp yeah, the way is installing testdisk before you ever need it. :D And then, after notice the problem stopping everything and doing the recovery.

sean

1/4/24, 12:17 PM

@guiverc even logging out of the machine will probably cause more chances of overwrite, before you can possibly do that all the caches will get flushed to disk before the unmount process begins. That's called "writing a crapload of files". :D

guiverc

1/4/24, 12:25 PM

I'd likely not logout & just shutdown with SysRq REISUO.... I'd always do a clean shutdown (*prevent other issues from appearing*) but use that surprisingly often (*would just do it subconsciously; sort of detail I'd likely miss writing an answer - brought out here only as you mentioned the logging out!*)

sean

1/4/24, 12:28 PM

@guiverc Yeah, every single file touched there is pretty dang scary. I mean we always see 100's of things flit off the screen. There are probably thousands of data points touched on one logout, hehe. I think you're better off taking your chances with installing testdisk immediately.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Is it possible to recover a deleted directory?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.