Bash history corrupted after power loss

Question

I went to the store and when I came back, I found that I had forgotten to plug in my laptop and It had died from a low battery. When I rebooted, I was surprised to find that my bash history, instead of containing my terminal commands, now looked like this:

don@don-Dell-PowerbookBook-777w:~$ �$6:�P!^G����^^B)A|E1����t^E���@=(�|0H�^N�s����+�����C�Ώ)p��s�  pn�ǡ!�ǝ\��"^H�n^M^Rs��$u�^[���^S����![�0^R&^R���@��T���v��8^T^N��^ZJ�O�*�Y$:�A�^[6��jٸ�EIl>��^L�ژ���^^^Xw^T^[��/^Q^Aw       ߨ~�>���s"�6d��^\�U%�a^M/p^P��iޠ��\^M^Z^9��^_l�]*�Ų���J͜��^UK�u�  ����N^S���^G5^B^D�p^^^E��4�&�Qi�^U^?�T^T��- 

And when I ran gedit .bash_history, I got this:

There was a problem opening the file “/home/dave/.bash_history”.

The file you opened has some invalid characters. If you continue editing this file you could corrupt this document. You can also choose another character encoding and try again.

Character Encoding: Current Locale(UTF-8)

and then:

\D3Q\F6\98ڵ\9B\A8a\9B\97\C7׬\A2\B5\F7\B0,.\B4\FD\E4N\A9͈\FEK\EF蓪*,q\D5HbI\C6!iB\BC\D33\A7\C5\EC\E3\\AE|\D1<%Hx9a\FEI\BE\93f\84\92\C1\AF\B7Ed,6DI<\B5\F9*t\00\DB]PZ\AE\EB\D2\A1e\8C\D4\F8\B4'\8A\CD\00F-\89\CBs\FD;k\CBUv\E1\F8߱y\D0;\BB\9E ůLteE\94\9B\D1\00\E7\CF)\\E51,\9C\81}\E6\96=\C7l\D8v.#s\CE\D5\C2%2\8EZ\93\93<\DD'oIKl.\CC81~\80\DC\F9\A5ȡ@6\E0\DA\F8\92j%\D2;: b(\BE\F5Dv\86\CD"\A0vCc\EC\A2\F8oP\88\CEG\ED~y\866\B9\AF\BF\BF\DC}\8F\94\CF\DB\C9\D6\DC\D9\E7\E4\DC-\94H\B3\A7\F3\DF\EB\9DS+\E5\C8\81p\8FK\E2\88h\E7f\A8\809\B4\FBo}&aa\FA;\B7q\E8\8D\DE\B5\B5\DE{\EB\A3\F9D\BB\E8\80\A0\FA\F2\F6\A2\BB\C6\D1\CEaN?*H8\91\BD\B83y\FF\BA)\DDl)\87vn\97D\EF\EEOS\F5\FB\B0U\83\94\E7D\E0:\A3R\94\EC\B9O\D9wr^D,Q\8B2\C1\9A;l\9Db\86@C*$\D4=\B7v\86ۉ\85\B5\D0g\85\C0{Cb\EA;\ACK\87q\FE\BA\83\B7\86\C0\DF

For hundreds upon hundreds of lines. Is there anyway to salvage this, or should I just bite the bullet and delete it all?

Answer 1

This question has answers which list various ways to perform a consistency check on the root partition. If the reboot you mentioned did not perform a consistency check, it might make sense to run fsck on your root partition. After fsck has completed (whether that already occurred during the reboot, or you perform it explicitly), your metadata will be consistent, but there is no guarantee about file contents being correct. An output log from fsck might provide some insight about the extent of the damage.

The particular problem with your bash history file looks like it erroneously contains data belonging to a completely different file. The best case for that might be that blocks were allocated to the history file, but not written before the power loss, in which case the present file contents might simply be whatever contents deallocated blocks happened to have before they were assigned to your bash history file. A more pessimistic interpretation of those file contents is that metadata was corrupted (in which case fsck is the likely course of action). You might want to keep an eye out for any other files which might have been affected. In the best case, only files with a sufficiently recent modification time will be problematic.

As for salvaging what's left of your bash history, a simple approach might be to feed it to the strings command (that should filter out most of what looks like binary content). It probably makes sense to override the default value of --bytes (-n) if you do that, to something closer to a likely minimum command length. Depending on how big your bash history file is, and the underlying reason for its bogus contents, there may or may not be any actual commands stored there.

It might make sense to rename your bash history file rather than immediately removing it, so that you can defer salvage efforts, and also have a bash history which won't cause trouble with the regular operation of bash.