How To Recover Deleted Files In Linux Using RM?

Similar to our smartphones, computers help us store volumes of data in the form of documents, audio files, videos, photos, etc. The pain of losing such valuable data is unbearable. It’s even more terrifying when you realize your lost files are not even in the trash.

There are numerous causes of data loss from accidental deletion, virus and malware attack, running the wrong command, failing hard drive, corrupt files, and software, etc. with this many causes, some of which are beyond our control, you really need to know how to recover deleted files regardless of your system.

One of the most common causes of data loss on Linux-based operating systems is running the wrong command. If you are a Linux user and accidentally deleted files, you have come to the right place. In this article, we show you how to recover deleted files in Linux using RM. Stay with us.

Can Linux Recover Deleted Files?

Fortunately, YES! There are a couple of utility tools that can do magic, i.e., you can use them to retrieve deleted files on your Linux computer. Keep in mind that the earlier you notice deleted files, the more likely the recovery process will be successful.

After accidentally deleting a file, the action you take determines the chances of it being recovered. Immediately you realize you have missing files, don’t mess up other files. Don’t delete, cut, copy, or paste files. Do not install applications unless they are really necessary. By doing this, you increase the likelihood of successful data recovery.

So, what happens when you delete a file on Linux? Every File in a Linux-based system occupies a range of disk nuggets made up of disk sectors. These files are stored on the disk as bits. When you delete a file, the Linux system removes all the nuggets associated with that particular File to create room for other files.

You can recover your files by running a few command lines or using built-in Linux or third-party data recovery tools such as TestDisk, Photorec, R-Linux, etc. These advanced recovery tools can bring back deleted documents, videos, audio, and photos.

Where Do Deleted Files Go In Linux?

Deleted files in the Linux system are detached from the file system directory structure and moved to ~/. local/share/Trash/files. These files continue to exist on your computer until they are permanently deleted. However, if you use the RM command to delete files, it permanently deletes them, and the space is allocated to a different file. The RM command works similarly to [Shift] + [Del] in Windows.

How To Recover Deleted Files In Linux Using RM?

Running wrong commands in Linux may sometimes lead to loss of data. If you have experienced this before and are now seeking a solution, we give you a complete guide on how to recover deleted files using RM. Before we go any further, what is an RM command?

The RM command is short for remove (ReMove). It is used to remove files, directories, and symbolic links from Linux-based file systems. The RM command works silently when deleting files and does not send files to the trash can. This means you should be very careful when using this command.

Now the big question is; is it possible to recover files after an RM command? The answer is yes. Here is how to do it:

• Step 1: Open the [Terminal].
• Step 2: Type in [init 1] and then press [Enter] on your keyboard. This command switches the Linux system to single-user mode.
• Step 3: Type in [grep -I -a ‘MyFile’/dev/ {your partition name}>file.txt]
  • -i ignores case sensitivity, i.e., matches lowercase and uppercase characters.
  • -a processes all binary files as text files.
  • MyFile shows the word your looked-for File starts with. It replaces it with one that fits your search.
  • Replace {your partition name} with the partition where your text files are.
• Step 4: Press [Enter].

Important tips to remember when recovering files using RM:

1. Once you run the RM command, do not copy, install or download anything new in the same drive; by doing so, you risk overwriting the files to be recovered.
2. Unmount the drive or power down your system. It is essential if accidentally erased files on the entire drive using the RM command. Unmounting interrupts the process.
3.  Hire professionals. If you are not sure of what to do, pay someone with experience to help you recover your files.

Read More: How Do I Recover Nomedia Files?

How to Recover Deleted Files in Linux Using Data Recovery tools

Remember that using the RM command in Terminal without any extra assistance to search for files is not worth the effort. Therefore, we recommend using additional data recovery software. On our list, we have selected a few to show you how they work:

Method 1: Recover Deleted Files Using TestDisk

TestDisk is a free, open-source application for data recovery. It is often used with Photorec. In some Linux versions, it comes pre-installed. Here is how to use it:

• Step 1: From your browser, download TestDisk, extract it from its archive, and install it.
• Step 2: Launch your application. You’ll notice it has a similar interface to [TerminalTerminal]
• Step 3: Scroll down to [Advanced] using your keyboard arrow keys. Press [Enter] to select.
• Step 4: Locate the drive/partition that contains your deleted files. Choose [Undelete].
• Step 5: Press [Enter] to begin the process. Once it is complete, it will display deleted files in red.
• Step 6: Highlight the files you want to recover, then press[C] to copy.
• Step 7: Navigate through the directories using the arrow keys until you find a location to copy your retrieved files. Press [Enter].

Method 2: Recover Deleted Files Using Photorec

Photorec is a Linux-based data recovery tool that works as a companion utility tool to TestDisk. Here is how to recover deleted files using Photorec:

• Step 1: Open [Terminal]
• Step 2: Run [sudo apt-get install TestDisk] to install Photorec, then call the application by running the command [sudo Photorec].
• Step 3: Choose the media where you want to recover deleted files. Select [Proceed] the press [Enter].

• Step 4: Choose your desired partition from the list on the screen. Now select [Options] and press [Enter]. You’ll get a menu with recovery options as shown below

• Step 5: Click on [File opt]. Select the preferred file extensions for the files you want to be recovered, then press [S] to save.
• Step 6: Click [Q] twice to return you back to the previous screen.
• Step 7: Select [Search] and press [Enter] to begin recovery. Specify whether the whole partition or free space should be analyzed.

• Step 8: Select where you want to save your recovered files. Press [C] to continue.

The process will begin, and once finished, it will show the number of retrieved files and their locations.

Method 3: Recover RM Deleted Files Using Ext3grep Tool

Ext3grep utility tool offers an excellent data recovery solution for files deleted by the RM command. Follow these easy steps to recover your files:

• Step 1: Launch [Terminal].
• Step 2: Use [apt-get upgrade] and [apt-get update] to upgrade and update your tool version.
• Step 3: Create an ext3 location with a storage size of 400MB. [$ sudo dd if=/dev/zero of=/tempfs bs=1M count=400]
• Step 4: Create a disk mounting using this command [$ sudo mkdir /mnt/data] [$ sudo mount –t ext3 /tempfs /mnt/data/] [$ df –hT].
• Step 5: Perform a data test. Once the file system has been mounted, remove the file on copying. Unmount the disk to prevent overwriting your files. [$ sudo cp –r /etc/services /mnt/data/] [$ ls –la /mnt/data/] [$ cd /mnt/data/] [$ sudo rm –f services] [$ cd /] [$ sudo umount /mnt/data].
• Step 6: Now install ext3grep using this command: [$ sudo apt-get install ext3grep].
• Step 7: Use ext3grep to find /tempfs. If the File was removed, use ext3grep utilities to show a list of all file names [$ sudo ext3grep –-dump-name /tempfs].
• Step 8: Use command: [$ sudo ext3grep –-restore-all /tempfs] [$ cs RESTORED_FILES/] [$ ls –la] to restore your deleted files.

Conclusion

Data recovery methods vary depending on file systems. One major benefit of Linux systems are their many built-in data recovery tools. Like other systems, Linux does not overwrite erased files immediately. If you accidentally erase data, you can easily recover it by unmounting the affected partition and running a recovery procedure.

We have explained several step-by-step procedures of how to recover deleted files in Linux using RM. We hope you found this information useful. If you run a multiple-user Linux system, you should immediately consider reverting to single-user mode before attempting data recovery.

Most importantly, if you’re not sure of any procedure above, we recommend seeking professional assistance. Let us know which of the procedures worked well for you in the comment section below.