How To Recover Deleted Files by RM Command on Linux (Ubuntu)

Here are the 3 methods to recover deleted files by RM command in Linux.

“Can files/directories deleted with rm be restored?” – askUbuntu

The "rm" command is a utility in Linux systems that allows you to delete files. However, sometimes you may accidentally delete important files using the rm command. There are even cases when this happens due to malware attacks, software-level corruption, or hard drive failure.

When it comes to Ubuntu, running the wrong command adds on. In such cases, it is possible to recover these deleted files using specific tools. This article will discuss how to recover deleted files in Linux using rm. We will explain the general concept of the “rm” command and the steps to recover files deleted by the rm command in Ubuntu using the GUI tool, command line tool, and extundelete.

Part 1: What Is the RM Command?

The "rm" command is a Linux utility used to delete files. It stands for "remove." When you use the rm command to delete a file, it is permanently removed from the file system and cannot be recovered easily. Therefore, it is essential to be careful when using the rm command, especially if you delete important files.

rm delete file command

Note: The rm command deletes files without asking for approval. As a result, it's essential to use caution when using it to prevent unintentionally destroying important files.

How To Use the RM Command?

It would be best if you opened a Terminal on your Linux system to use the rm command. You can delete a file using the rm command by typing the command and the file's name in the Terminal. As an example, you remove a file. The path to the file must be specified if it is in a separate directory. By separating the names of the files with a space, you can also remove multiple files at once.

The basic syntax for using the rm command is:

rm [options] file

Here, "file" is the name of the file that you want to delete. You can specify multiple files to be deleted by separating them with a space.

Deleting single file: If you want to delete a single file, you have to use the “rm” command followed by the file's name as an argument.

rm filename

Deleting multiple files: You just need to pass the filenames as arguments separated by space if you want to delete multiple files.

rm filename1 filename2 filename3 filename 4

Removing directories: If you want to remove one or more than one directory, you have to use "-d".

rm -d dirname

You can use several options with the rm command to modify its behavior. For example,

  • The "-i" option forces the rm command to prompt for confirmation before deleting each file. It will display a message asking if you want to delete each file, and you can choose to delete or skip the file by typing "y" or "n," respectively.
  • The "-f" option forces the rm command to ignore non-existent files and not prompt confirmation. It is helpful if you want to delete multiple files and wonder if some might not exist. The rm command will ignore the non-existent files and delete the rest.
  • The "-r" option allows you to delete directories and their contents recursively. It will delete the directory and all its files and subdirectories. Be careful when using the "-r" option, as it can delete many files at once and is not reversible.

It is worth noting that the rm command does not send the deleted files to the trash bin or recycle bin. Instead, it permanently removes them from the file system, so it is important to be careful when using them.

Free Download

For Windows XP/Vista/7/8/10/11

Free Download

For macOS X 10.10 - macOS 13

Where Do Files Go When Running the RM Command

Let's quickly review the Linux filesystem's operation before moving to where the files are stored. The system establishes a link to the file when we create it. The system then uses these links to locate files on the disk.

The system only removes the link to the file when we use the rm command. It means that the file's actual data is still present on the disk. Because of this, when we use the rm command, the filesystem deletes the references to the files and informs the operating system that the storage blocks have been released.

The rm command often instructs the system to mark the file's inode and data blocks as unused. Data recovery was once possible in earlier Linux versions, but nothing can be recovered these days because the metadata has been erased.

There is no recycle bin or trash can with the rm command. Use the GUI, where files are typically relocated to the trash directory when removed if we need a recycle bin.

Does RM Permanently Delete Files on Linux?

Yes, when you use the rm command to delete a file in Linux, it is permanently removed from the file system and cannot be easily recovered. The rm command does not send the deleted files to the trash or recycle bin, as with some desktop environments. Instead, it permanently removes the files from the file system, so it is important to be careful when using it.

Even though the rm command permanently removes the files from the file system, it is still possible to recover the deleted files in some cases. It is because when a file is deleted, the system only marks the space occupied by the file as available for reuse, but the actual data is not immediately overwritten. Therefore, retrieving deleted files using specific tools is possible if new data has not been overwritten.

Part 2: Recover RM Files in Linux Using Wondershare Recoverit (GUI Tool)

We've all experienced the frustration of seeking a file to have it vanish, even in the trash. Well, that case will not be a problem anymore. Consider employing a third-party tool to recover your deleted files by RM command. One highly recommended tool is the Wondershare Recoverit Linux Recovery. Recoverit is a one-stop Linux data recovery solution that proudly offers its professional grade features like:

Wondershare Recoverit – Your Safe and Reliable Linux Recovery Software

5,481,435 people have downloaded it.

Recovers lost or deleted documents, photos, videos, music, emails, and other 1000+ file types effectively, safely, and completely.

Compatible with all mainstream Linux distros, including Ubuntu, Linux Mint, Debian, Fedora, Solus, Opensuse, Manjaro, etc.

Assists in 500+ data loss scenarios, such as deletion, disk formatting, OS crash, power outage, virus attack, lost partition, and many more.

The simple point-and-click interface allows you to recover data from Linux hard drives in just a few clicks.

With 3 simple steps, you can quickly recover your deleted files using the RM command in Linux (Here, we use Ubuntu as an example). Follow the detailed instruction below to do so:

Step 1. Pick Linux Recovery as your option.

Go to the NAS and Linux after downloading and installing Wondershare Recoverit on your computer, then choose Linux Recovery.

linux recovery option

Step 2. Connect to the Linux device.

By providing the IP address, port number, username, and password, you can connect the Linux File Recovery tool to your Ubuntu computer system.

connect to the linux device

Step 3. Deleted Files Scan and Recovery.

Recoverit will start looking for missing data on your Ubuntu device as soon as you connect. You can preview the files to ensure that it’s the file you want to recover. To restore the deleted files on Ubuntu, click Recover.

recover deleted rm files on ubuntu
Free Download

For Windows XP/Vista/7/8/10/11

Free Download

For macOS X 10.10 - macOS 13

More Related: How To Undo rm in Linux?

Video Tutorial on How to Recover Linux Files?

Free Download

For Windows XP/Vista/7/8/10/11

Free Download

For macOS X 10.10 - macOS 13

Part 3: Recover RM Files in Linux Using TestDisk (CLI Tool)

Don't worry if you accidentally delete a file by RM command on your Ubuntu system; TestDisk will come to your aid. This method is highly applicable to those experienced enough to execute commands in Linux.

The TestDisk is a free, open-source program initially created to recover memory partitions and make unbootable disks bootable. It ends the agony that comes with file and data loss. It helps restore data from partitions damaged by viruses or human error.

These are the steps to use the TestDisk data recovery program to restore deleted files by RM in Linux. First, install TestDisk.

Step 1: Make a TestDisk Data Log File.

To recover files deleted by RM, first, create a testdisk.log file. Choose the Create option. Depending on the system's security, the computer may ask for the sudo password to continue with the recovery.

make a testdisk data log file

Step 2: Select a Recovery Drive.

Testdisk will display all disks with their total storage and free space on your system. Select the drive where your data is saved. Use the arrow keys to explore the options and select Proceed. Then, press the ENTER key. Your system may not display some drives depending on the security permissions. In such cases, select Sudo, located next to the Proceed and Quit buttons.

select a recovery drive

Step 3: Choosing a Partition Table Type.

The system will predict and highlight the best option automatically. To proceed, click ENTER. Because we are attempting to recover a deleted file, we will choose Advanced.

choosing a partition table type

Step 4: Select the Source Drive Partition for Deleted Files.

Select your option and press ENTER.

select the source drive partition

Step 5: Examine the Source Directory for Deleted Files.

Navigate to the specific directory where you lost or deleted your file after the utility displays the system directories for all partitions. After navigating to the source directory, the deleted files will be highlighted in red. Select your file from the drop-down menu, then highlight or check it.

examine the source directory

Step 6: Restoring a Deleted File in Linux

Testdisk utility will then show you a list of locations where you can paste your copied file to recover it. Again, please scroll to the destination and, as before, press C to paste it.

restoring a deleted file by rm in linux

After recovering your deleted files, select Quit and press ENTER to exit the Testdisk utility. It will return you to the previous screen.

quit testdisk utility after recovery

Part 4: Recover RM Files in Linux Using Extundelete (ext3grep Successor)

If you fail to recover your deleted files by RM command using GUI Tool and command line application, maybe it’s time to consider an ext3grep successor or by employing Extundelete.

Extundelete is a tool that can help you restore deleted files from an ext3 or ext4 file system. It works by scanning the file system for deleted inodes (data structures that hold information about files) and trying to recover the contents of those files.

extundelete linux data recovery utility

Remember that Extundelete may not be able to recover all deleted files, especially if the file system has been heavily used since the file was deleted. However, it can be a useful tool if you have accidentally deleted an important file and want to try to recover it.

To use Extundelete, you will need to have the ext3 or ext4 file system driver installed on your system and the Extundelete program itself. Once you have both things installed, you can follow these steps to recover deleted files by RM command.

Step 1. Use the command below to restore files. The file path is relative to the root of the partition.

sudo extundelete --restore-file picture.jpg /dev/sdb1

recover rm files on ubuntu using extundelete

Step 2. The /dev/sdb1 partition's files are all recovered with the following command. The partition name should be changed to reflect the name of your source.

sudo extundelete --restore-all /dev/sdb1

Step 3. Use the the-o option to specify a directory to save the recovered files. By default, Extundelete stores the restored files in the RECOVERED_FILES/ sub-directory.

sudo extundelete -o ~/recovery --restore-all /dev/sdb1

Conclusion

Using the RM command, you can quickly erase your files. However, you may accidentally delete important files. So, as a solution to this problem, this article provided you with the 3 most effective methods to recover deleted files in Linux using RM.

Other popular Articles From Wondershare