The Short Answer
Yes, it is possible to recover deleted files using the terminal, but the process depends on your operating system and file system. On Linux or macOS, you may be able to recover deleted files from the command line if they have not been overwritten. On Windows, command line recovery is more limited.
Recovering Deleted Files on Linux/macOS
On Linux and macOS, files deleted from the terminal are not immediately removed from the file system. Instead, the space they occupied is marked as free and available for new data. As long as the deleted file’s disk space has not been overwritten, recovery should be possible.
The first step is to stop using the disk containing the deleted file, to avoid overwriting the data you want to recover. Then you can attempt to recover the file in one of two ways:
Searching with find
You can use the find command to search for the deleted file by name. For example:
find / -name "deleted_file.txt"
This will recurse through the entire filesystem looking for a file called “deleted_file.txt”. If find is able to locate the inode for the deleted file, it will display the file’s name and location.
You can then copy or move the recovered file to a new location. For example:
cp /tmp/found_file.txt /home/user/recovered_file.txt
Using debugfs or extundelete
On Linux systems with EXT filesystems, you can also use debugfs or extundelete to recover deleted files. These tools can find and restore deleted inodes.
For example, to recover deleted files with debugfs:
debugfs -w /dev/sda1
debugfs: undelete /path/to/inode /destination/path
Or with extundelete:
extundelete /dev/sda1 --restore-all
This will recover deleted files from the /dev/sda1 partition and restore them to a folder.
File Recovery Success Depends on Overwrites
Whether using find, debugfs, extundelete, or other file recovery tools, recovery success ultimately depends on whether the area of the disk containing the deleted file’s data has been overwritten with new data. The sooner you stop using the disk and attempt recovery, the greater your chances.
Recovering Deleted Files on Windows
On Windows, command line file recovery options are more limited than on Linux/macOS. There are no native Windows commands that can scan and restore deleted files. However, there are some third-party tools available:
Using TestDisk
TestDisk is an open source data recovery utility that works on Windows. It can be used from the command line to find and recover deleted files. For example:
testdisk /log recover_log.txt
photorec /d recup_dir
This scans the disk and recovers files to the recup_dir directory, logging details to recover_log.txt. TestDisk attempts to recover files based on their headers and file signatures rather than file names.
Using Recuva
Recuva from Piriform is another data recovery tool with command line support on Windows. To launch a wizard-style recovery from the CLI:
recuva -wizard
You can then walk through the recovery process to scan for and restore deleted files.
Using Shadow Explorer
If System Restore / Volume Shadow Copy was enabled on the Windows system, you may be able to access previous versions of deleted files using Shadow Explorer. This can only recover files that were backed up by Shadow Copy.
From the command line, Shadow Explorer would be used like:
ShadowExplorer.exe [/path c:\mount] [/sort] [/quit] [/hide vssstore] [/exp export.csv]
This mounts shadow copy snapshots as disks that you can browse to find deleted files.
Preventing File Deletion
To avoid needing file recovery in the future, there are some best practices you can follow:
- Be very careful when using rm or deletion commands. Double check paths and file names.
- Set up trash/recycle bin functionality on Linux so files are not immediately deleted.
- Enable Shadow Copies or System Restore on Windows.
- Backup important files regularly.
- Use version control systems like git to track file history.
Following these practices will help mitigate accidental file deletion and data loss. But when you do need to recover lost files, utilities like TestDisk, Photorec, Recuva, and Shadow Explorer provide options on Windows, while Linux tools like find, debugfs, and extundelete can help recover deleted files if space has not been overwritten.
Frequently Asked Questions
Can you recover fully overwritten files?
No, if a deleted file’s disk space has been completely overwritten with new data, it is generally impossible to recover the original contents. The new data has destroyed the old.
What is the best deleted file recovery software?
On Linux, extundelete and debugfs work well for EXT file systems, while TestDisk can recover from multiple file system types. For Windows, Recuva and Shadow Explorer provide good results in different data loss scenarios.
How long are deleted files recoverable?
It depends on the operating system and storage medium. On spinning hard drives, recovery is possible until the space is reused, which may be days or weeks. On SSDs, trimmed files may only be recoverable for hours. The sooner recovery is attempted, the better.
Can you recover files deleted from the command line?
Yes, the same undelete utilities can recover files deleted with rm or other terminal commands. As long as the storage space has not been overwritten, recovery should be possible.
What if I permanently deleted files with srm or sdelete?
If you used a secure delete tool like srm or sdelete, these delete files by overwriting their disk space, making recovery much less likely to succeed. Your best bet is from a backup.
Conclusion
While it is possible to recover deleted files from the command line on Linux, macOS, and to some extent Windows, results depend heavily on disk space not being reused or overwritten with new data. The more a drive is used after deletion, the lower the chances of recovery. Best practices like backups and version control can help mitigate data loss, but when necessary, utilities like TestDisk, Photorec, Recuva, and Shadow Explorer provide some undelete capabilities. Just be sure to act quickly before new writes make recovery impossible.