Trying to Recover Deleted Files?

Linux for blind general discussion blinux-list at
Thu Aug 18 02:34:48 UTC 2022

Tim here.  There are two separate matters at play:

1) recovering deleted files

2) mitigating it from happening again in the future

When it comes to undeleting the files that were deleted, there are
a lot of variables at play--the file system (ext2, ext3, ext4, XFS,
JFS, ZFS, etc), whether the disk was encrypted, the underlying disk
arrangement if it's LVM, and the types of files that were deleted.

However, the most important thing is to not write anything else to
the drive until you've taken a disk image that you can operate on.
If you can, reboot into a live boot environment (such as a live CD
or live USB), and use dd(1) to make an image of your drive to another
larger drive.  Once you have that, you can operate on the drive,
secure in the knowledge that it shouldn't get any *worse*.

Some file-types have internal characteristics such as JPG image
files and there are programs like "recoverjpeg" that can scavenge
the raw sectors of a disk image and find things that have the shape
of a JPG image and recover those.  Unfortunately, MP3 files don't
seem to have a consistent "magic number" (some identifying bytes
at the beginning of the file) which makes it a bit more of a challenge
to extract the raw bits.

There are some undelete utilities, but I've had mixed success.  So
I'm afraid I don't have much good news about recovering the deleted

For the mitigation aspect, I like how ZFS does it.  Snapshots are
nearly instantaneous, and only occupy as much space as the delta
from from its neighbors.  So they're storage-efficient too.  There
are some wrappers that take a snapshot every N minutes/hours/days,
and they then manage those snapshots, winnowing out older ones after
a time.  Every snapshot is available under a hidden .zfs directory
in the root zpool, making it easy to recover files.  It's still no
alternative to a backup, but it has saved me on several occasions.

Unfortunately, ZFS on Linux is not as trivial to do as it is on
FreeBSD (which is what I use as my daily driver).

That said, there are other processes that you can run that will
take regular backups of your system, either to the same drive or
to an external backup device.  So it sounds like this might be one
of your best options.

I just wish I had more encouraging word for you.


On 2022-08-17 18:15, Linux for blind general discussion wrote:
> We interrupt this discussion to bring you a new topic.
> Hi All: Back on August 01, I ripped several streams of President Biden's
> speech on Afghanistan. I have a script to convert from mp3 to an aac.
> However, in my haste, instead of just deleting the mp3s in that directory, I
> nuked all audio files I recorded that day. I know, I need a backup strategy,
> something where any file which I nuke would endup in a temporary trash for
> like 6 hours. Usually when I make similar errors, I know rather fast.
> So, many years ago, when I was in DOS, I could type "undelete" and it would
> provide a list of files, which you fill in the first letter. I gather
> recovering files in a Debian SID system is complicated? 1 of my Linux
> experts suggested I install testdisk. Trouble is it really doesn't read well
> in speakup. Another of my experts ran it here, says I have an LVM. Seemingly
> running a df -h shows home as /dev/sda3. At this point I only need files I
> nuked from August 01. Can some1 please inform of either packages or
> sequences I can run to try-and-restore these? I suppose if I can use a
> wild-card in that directory or provide it on a commandline? Thanks so much
> in advance
> Chime
> _______________________________________________
> Blinux-list mailing list
> Blinux-list at

More information about the Blinux-list mailing list