grep_recovery.sh

# using grep to restore accidentally deleted txt files from a disk

# create test file
echo -e '#!/bin/bash\necho this is a delete test' >> delete_test.sh

# make it executable && run for a test
chmod +x ./delete_test.sh && ./delete_test.sh

# delete the file
rm -f ./delete_test.sh

# get the partition of the hard drive the deleted file was on. this can be found using df
[] burdz@~: df
Filesystem                 1K-blocks     Used Available Use% Mounted on
udev                         8084796        0   8084796   0% /dev
tmpfs                        1619440    34668   1584772   3% /run
/dev/mapper/krack--vg-root 474164296 25011520 424996824   6% /
tmpfs                        8097188  1017676   7079512  13% /dev/shm
tmpfs                           5120        4      5116   1% /run/lock
tmpfs                        8097188        0   8097188   0% /sys/fs/cgroup
/dev/nvme0n1p2                241965    67083    162390  30% /boot
/dev/nvme0n1p1                523248      132    523116   1% /boot/efi
tmpfs                        1619436       28   1619408   1% /run/user/117
tmpfs                        1619436       72   1619364   1% /run/user/1000

# grep for the strings in the deleted file on the device (sudo might be required)
sudo grep -a -B 25 -A 100 'this is a delete test' /dev/mapper/krack--vg-root > results.txt

# there will be a lot of unreadable data however the script should be results.txt
[] burdz@~: cat results.txt | grep -z '#!/bin/bash\sthis is a delete test'
#!/bin/bash
this is a delete test