“Can files/directories deleted with rm be restored?” – askUbuntu
The "rm" command is a utility in Linux systems that allows you to delete files. However, sometimes you may accidentally delete important files using the rm command. There are even cases when this happens due to malware attacks, software-level corruption, or hard drive failure.
When it comes to Ubuntu, running the wrong command adds on. In such cases, it is possible to recover these deleted files using specific tools. This article will discuss how to recover deleted files in Linux using rm. We will explain the general concept of the “rm” command and the steps to recover files deleted by the rm command in Ubuntu using the GUI tool, command line tool, and extundelete.
Part 1: What Is the RM Command?
The "rm" command is a Linux utility used to delete files. It stands for "remove." When you use the rm command to delete a file, it is permanently removed from the file system and cannot be recovered easily. Therefore, it is essential to be careful when using the rm command, especially if you delete important files.
Note: The rm command deletes files without asking for approval. As a result, it's essential to use caution when using it to prevent unintentionally destroying important files.
How To Use the RM Command?
It would be best if you opened a Terminal on your Linux system to use the rm command. You can delete a file using the rm command by typing the command and the file's name in the Terminal. As an example, you remove a file. The path to the file must be specified if it is in a separate directory. By separating the names of the files with a space, you can also remove multiple files at once.
The basic syntax for using the rm command is:
rm [options] file
Here, "file" is the name of the file that you want to delete. You can specify multiple files to be deleted by separating them with a space.
Deleting single file: If you want to delete a single file, you have to use the “rm” command followed by the file's name as an argument.
rm filename
Deleting multiple files: You just need to pass the filenames as arguments separated by space if you want to delete multiple files.
rm filename1 filename2 filename3 filename 4
Removing directories: If you want to remove one or more than one directory, you have to use "-d".
rm -d dirname
You can use several options with the rm command to modify its behavior. For example,
- The "-i" option forces the rm command to prompt for confirmation before deleting each file. It will display a message asking if you want to delete each file, and you can choose to delete or skip the file by typing "y" or "n," respectively.
- The "-f" option forces the rm command to ignore non-existent files and not prompt confirmation. It is helpful if you want to delete multiple files and wonder if some might not exist. The rm command will ignore the non-existent files and delete the rest.
- The "-r" option allows you to delete directories and their contents recursively. It will delete the directory and all its files and subdirectories. Be careful when using the "-r" option, as it can delete many files at once and is not reversible.
It is worth noting that the rm command does not send the deleted files to the trash bin or recycle bin. Instead, it permanently removes them from the file system, so it is important to be careful when using them.
For Windows XP/Vista/7/8/10/11
For macOS X 10.10 - macOS 13
Where Do Files Go When Running the RM Command
Let's quickly review the Linux filesystem's operation before moving to where the files are stored. The system establishes a link to the file when we create it. The system then uses these links to locate files on the disk.
The system only removes the link to the file when we use the rm command. It means that the file's actual data is still present on the disk. Because of this, when we use the rm command, the filesystem deletes the references to the files and informs the operating system that the storage blocks have been released.
The rm command often instructs the system to mark the file's inode and data blocks as unused. Data recovery was once possible in earlier Linux versions, but nothing can be recovered these days because the metadata has been erased.
There is no recycle bin or trash can with the rm command. Use the GUI, where files are typically relocated to the trash directory when removed if we need a recycle bin.
Does RM Permanently Delete Files on Linux?
Yes, when you use the rm command to delete a file in Linux, it is permanently removed from the file system and cannot be easily recovered. The rm command does not send the deleted files to the trash or recycle bin, as with some desktop environments. Instead, it permanently removes the files from the file system, so it is important to be careful when using it.
Even though the rm command permanently removes the files from the file system, it is still possible to recover the deleted files in some cases. It is because when a file is deleted, the system only marks the space occupied by the file as available for reuse, but the actual data is not immediately overwritten. Therefore, retrieving deleted files using specific tools is possible if new data has not been overwritten.
Part 2: Recover RM Files in Linux Using Wondershare Recoverit (GUI Tool)
We've all experienced the frustration of seeking a file to have it vanish, even in the trash. Well, that case will not be a problem anymore. Consider employing a third-party tool to recover your deleted files by RM command. One highly recommended tool is the Wondershare Recoverit Linux Recovery. Recoverit is a one-stop Linux data recovery solution that proudly offers its professional grade features like:
Wondershare Recoverit – Your Safe and Reliable Linux Recovery Software
5,481,435 people have downloaded it.
Recovers lost or deleted documents, photos, videos, music, emails, and other 1000+ file types effectively, safely, and completely.
Compatible with all mainstream Linux distros, including Ubuntu, Linux Mint, Debian, Fedora, Solus, Opensuse, Manjaro, etc.
Assists in 500+ data loss scenarios, such as deletion, disk formatting, OS crash, power outage, virus attack, lost partition, and many more.
The simple point-and-click interface allows you to recover data from Linux hard drives in just a few clicks.
With 3 simple steps, you can quickly recover your deleted files using the RM command in Linux (Here, we use Ubuntu as an example). Follow the detailed instruction below to do so:
Step 1. Pick Linux Recovery as your option.
Go to the NAS and Linux after downloading and installing Wondershare Recoverit on your computer, then choose Linux Recovery.
Step 2. Connect to the Linux device.
By providing the IP address, port number, username, and password, you can connect the Linux File Recovery tool to your Ubuntu computer system.
Step 3. Deleted Files Scan and Recovery.
Recoverit will start looking for missing data on your Ubuntu device as soon as you connect. You can preview the files to ensure that it’s the file you want to recover. To restore the deleted files on Ubuntu, click Recover.
For Windows XP/Vista/7/8/10/11
For macOS X 10.10 - macOS 13
More Related: How To Undo rm in Linux?
Video Tutorial on How to Recover Linux Files?
For Windows XP/Vista/7/8/10/11
For macOS X 10.10 - macOS 13
Part 3: Recover RM Files in Linux Using TestDisk (CLI Tool)
Don't worry if you accidentally delete a file by RM command on your Ubuntu system; TestDisk will come to your aid. This method is highly applicable to those experienced enough to execute commands in Linux.
The TestDisk is a free, open-source program initially created to recover memory partitions and make unbootable disks bootable. It ends the agony that comes with file and data loss. It helps restore data from partitions damaged by viruses or human error.
These are the steps to use the TestDisk data recovery program to restore deleted files by RM in Linux. First, install TestDisk.
Step 1: Make a TestDisk Data Log File.
To recover files deleted by RM, first, create a testdisk.log file. Choose the Create option. Depending on the system's security, the computer may ask for the sudo password to continue with the recovery.
Step 2: Select a Recovery Drive.
Testdisk will display all disks with their total storage and free space on your system. Select the drive where your data is saved. Use the arrow keys to explore the options and select Proceed. Then, press the ENTER key. Your system may not display some drives depending on the security permissions. In such cases, select Sudo, located next to the Proceed and Quit buttons.
Step 3: Choosing a Partition Table Type.
The system will predict and highlight the best option automatically. To proceed, click ENTER. Because we are attempting to recover a deleted file, we will choose Advanced.
Step 4: Select the Source Drive Partition for Deleted Files.
Select your option and press ENTER.
Step 5: Examine the Source Directory for Deleted Files.
Navigate to the specific directory where you lost or deleted your file after the utility displays the system directories for all partitions. After navigating to the source directory, the deleted files will be highlighted in red. Select your file from the drop-down menu, then highlight or check it.
Step 6: Restoring a Deleted File in Linux
Testdisk utility will then show you a list of locations where you can paste your copied file to recover it. Again, please scroll to the destination and, as before, press C to paste it.
After recovering your deleted files, select Quit and press ENTER to exit the Testdisk utility. It will return you to the previous screen.
Part 4: Recover RM Files in Linux Using Extundelete (ext3grep Successor)
If you fail to recover your deleted files by RM command using GUI Tool and command line application, maybe it’s time to consider an ext3grep successor or by employing Extundelete.
Extundelete is a tool that can help you restore deleted files from an ext3 or ext4 file system. It works by scanning the file system for deleted inodes (data structures that hold information about files) and trying to recover the contents of those files.
Remember that Extundelete may not be able to recover all deleted files, especially if the file system has been heavily used since the file was deleted. However, it can be a useful tool if you have accidentally deleted an important file and want to try to recover it.
To use Extundelete, you will need to have the ext3 or ext4 file system driver installed on your system and the Extundelete program itself. Once you have both things installed, you can follow these steps to recover deleted files by RM command.
Step 1. Use the command below to restore files. The file path is relative to the root of the partition.
sudo extundelete --restore-file picture.jpg /dev/sdb1
Step 2. The /dev/sdb1 partition's files are all recovered with the following command. The partition name should be changed to reflect the name of your source.
sudo extundelete --restore-all /dev/sdb1
Step 3. Use the the-o option to specify a directory to save the recovered files. By default, Extundelete stores the restored files in the RECOVERED_FILES/ sub-directory.
sudo extundelete -o ~/recovery --restore-all /dev/sdb1
Conclusion
Using the RM command, you can quickly erase your files. However, you may accidentally delete important files. So, as a solution to this problem, this article provided you with the 3 most effective methods to recover deleted files in Linux using RM.