How To Recover Deleted Files by RM Command on Linux (Ubuntu)

“Can files/directories deleted with rm be restored?” – askUbuntu

The "rm" command is a utility in Linux systems that allows you to delete files. However, sometimes you may accidentally delete important files using the rm command. There are even cases when this happens due to malware attacks, software-level corruption, or hard drive failure.

When it comes to Ubuntu, running the wrong command adds on. In such cases, it is possible to recover these deleted files using specific tools. This article will discuss how to recover deleted files in Linux using rm. We will explain the general concept of the rm command and the steps to recover files deleted by the rm command in Ubuntu using the GUI tool, command line tool, and extundelete.

Part 1: What Is the RM Command?

The "rm" command is a Linux utility used to delete files. It stands for "remove." When you use the rm command to delete a file, it is permanently removed from the file system and cannot be recovered easily. Therefore, it is essential to be careful when using the rm command, especially if you delete important files.

How To Use the RM Command?

It would be best if you opened a Terminal on your Linux system to use the rm command. You can delete a file using the rm command by typing the command and the file's name in the Terminal. As an example, you remove a file. The path to the file must be specified if it is in a separate directory. By separating the names of the files with a space, you can also remove multiple files at once.

The basic syntax for using the rm command is:
rm [options] file

Here, "file" is the name of the file that you want to delete. You can specify multiple files to be deleted by separating them with a space.

Deleting single file: If you want to delete a single file, you have to use the “rm” command followed by the file's name as an argument.
rm filename

Deleting multiple files: You just need to pass the filenames as arguments separated by space if you want to delete multiple files.
rm filename1 filename2 filename3 filename 4

Removing directories: If you want to remove one or more than one directory, you have to use "-d".
rm -d dirname

You can use several options with the rm command to modify its behavior. For example,

It is worth noting that the rm command does not send the deleted files to the trash bin or recycle bin. Instead, it permanently removes them from the file system, so it is important to be careful when using them.

Where Do Files Go When Running the RM Command

Let's quickly review the Linux filesystem's operation before moving to where the files are stored. The system establishes a link to the file when we create it. The system then uses these links to locate files on the disk.

The system only removes the link to the file when we use the rm command. It means that the file's actual data is still present on the disk. Because of this, when we use the rm command, the filesystem deletes the references to the files and informs the operating system that the storage blocks have been released.

The rm command often instructs the system to mark the file's inode and data blocks as unused. Data recovery was once possible in earlier Linux versions, but nothing can be recovered these days because the metadata has been erased.

There is no recycle bin or trash can with the rm command. Use the GUI, where files are typically relocated to the trash directory when removed if we need a recycle bin.

Does RM Permanently Delete Files on Linux?

Yes, when you use the rm command to delete a file in Linux, it is permanently removed from the file system and cannot be easily recovered. The rm command does not send the deleted files to the trash or recycle bin, as with some desktop environments. Instead, it permanently removes the files from the file system, so it is important to be careful when using it.

Even though the rm command permanently removes the files from the file system, it is still possible to recover the deleted files in some cases. It is because when a file is deleted, the system only marks the space occupied by the file as available for reuse, but the actual data is not immediately overwritten. Therefore, retrieving deleted files using specific tools is possible if new data has not been overwritten.

Part 2: Recover RM Files in Linux Using Wondershare Recoverit (GUI Tool)

We've all experienced the frustration of seeking a file to have it vanish, even in the trash. Well, that case will not be a problem anymore. Consider employing a third-party tool to recover your deleted files by RM command. One highly recommended tool is the Wondershare Recoverit Linux Recovery. Recoverit is a one-stop Linux data recovery solution that proudly offers its professional grade features like:

Wondershare Recoverit – Your Safe and Reliable Linux Recovery Software

Try It Free Try It Free

5,481,435 people have downloaded it.

Recovers lost or deleted documents, photos, videos, music, emails, and other 1000+ file types effectively, safely, and completely.

Compatible with all mainstream Linux distros, including Ubuntu, Linux Mint, Debian, Fedora, Solus, Opensuse, Manjaro, etc.

Assists in 500+ data loss scenarios, such as deletion, disk formatting, OS crash, power outage, virus attack, lost partition, and many more.

The simple point-and-click interface allows you to recover data from Linux hard drives in just a few clicks.

With 3 simple steps, you can quickly recover your deleted files using the RM command in Linux (Here, we use Ubuntu as an example). Follow the detailed instruction below to do so:

More Related: How To Undo rm in Linux?

Video Tutorial on How to Recover Linux Files?

Part 3: Recover RM Files in Linux Using TestDisk (CLI Tool)

Don't worry if you accidentally delete a file by rm command on your Ubuntu system; TestDisk for Linux will come to your aid. This method is highly applicable to those experienced enough to execute commands in Linux.

The TestDisk is a free, open-source program initially created to recover memory partitions and make unbootable disks bootable. It ends the agony that comes with file and data loss. It helps restore data from partitions damaged by viruses or human error.

These are the steps to use the TestDisk data recovery program to restore deleted files by rm in Linux. First, install TestDisk.

After recovering your files deleted by rm, select Quit and press ENTER to exit the Testdisk utility. It will return you to the previous screen.

Part 4: Recover RM Files in Linux Using Extundelete (ext3grep Successor)

If you fail to recover your deleted files by rm command using GUI Tool and command line application, maybe it’s time to consider an ext3grep successor or by employing Extundelete.

Extundelete is a tool that can help you restore deleted files from an ext3 or ext4 file system. It works by scanning the file system for deleted inodes (data structures that hold information about files) and trying to recover the contents of those files.

Remember that Extundelete may not be able to recover all rm deleted files, especially if the file system has been heavily used since the file was deleted. However, it can be a useful tool if you have accidentally deleted an important file and want to try to recover it.

To use Extundelete, you will need to have the ext3 or ext4 file system driver installed on your system and the Extundelete program itself. Once you have both things installed, you can follow these steps to recover deleted files by RM command.

Conclusion

Using the rm command, you can quickly erase your files. However, you may accidentally delete important files. So, as a solution to this problem, this article provided you with the 3 most effective methods to recover deleted files in Linux using rm.