Skip to content

Instantly share code, notes, and snippets.

@aniket91
Created October 15, 2016 19:12
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save aniket91/3e43e8184890fc0205d0f8a0ead19455 to your computer and use it in GitHub Desktop.
Save aniket91/3e43e8184890fc0205d0f8a0ead19455 to your computer and use it in GitHub Desktop.
Shell script to recover deleted files on Linux
#!/bin/bash
if [[ ! $1 ]]; then
echo -e "Usage:\n\n\t$0 'file name'"
exit 1
fi
f=$(ls 2>/dev/null -l /proc/*/fd/* | fgrep "$1 (deleted" | awk '{print $9}')
if [[ $f ]]; then
echo "fd $f found..."
cp -v "$f" "$1"
else
echo >&2 "No fd found..."
exit 2
fi
@pepa65
Copy link

pepa65 commented Oct 18, 2016

The awk step is dangerous if there are any spaces in the path or filename, it will not give you the right filename (and it might exist..!)
Safer: sed -e 's/^[^>]* -> //' -e 's/ (deleted)$//'
And also the fgrep would be safer like: fgrep "$1 (deleted)$"
In theory, another problem would be existing opened files that end in ' (deleted)' which will show up...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment