Can I undelete files in a directory I deleted in Unix - Centos

Question

Dumb Question - Can I undelete files in a directory I deleted in Unix - Centos.

Is this possible ?

Answer 1

You can do this with testdisk. It works for ext2 - ext4, FAT, exFAT, and NTFS in Linux. This assumes that the data hasn't been overwritten since its deletion.

---

First method:

yum install testdisk

Second methond:

Get it from here https://github.com/cgsecurity/testdisk and download it to and compile it from source on another drive. The reason that you might want to do this is that installing software directly to a drive can cause the deleted data to be overwritten as the system will have marked the space that it's using as no longer in use and free to be overwritten.

• Run testdisk from the terminal or use the location to its binary that you compiled.
• Select Create a new log file from the menu.
• Select your drive. You may need to select sudo and enter the password first to see all of your drives if you have more than one.
• Select the partition. It will usually select it for you and it'll either be None or Intel.
• Select Advanced.
• Select Undelete.

After a scan, it'll produce a list of deleted files which will be red when they appear. Use the arrow key to select the file and use the c key to copy the file. There are options for where you want to copy the file to but if it's your /home directory by default. Do this with all of the files that you want to recover.

In any event, if you've been using the system since deleting the files, it's possible that the deleted data has already been overwritten in which case there's nothing that you can do other than take it to a data recovery agency. It's for this reason that it's always important to make regular backups of important data.