Friday, March 24, 2006

Recover deleted files in Linux/Unix

This process works mainly for text files only
As root user type init 1 command to go to single user mode.
# init 1
Use the folowing grep syntax
grep -b 'search-text' /dev/partition > file.txt
or this one
grep -a -B[size before] -A[size after] 'text' /dev/[your_partition] > file.txt

-i : Ignore case distinctions in both the PATTERN and the input files i.e. match both uppercase and lowercase character.
-a : Process a binary file as if it were text
-B Print number lines/size of leading context before matching lines.
-A: Print number lines/size of trailing context after matching lines.

To recover text file starting with "abc" word on /dev/sda1 you can try following command:
# grep -i -a -B10 -A100 'abc' /dev/sda1 > file.txt
Use any editor to see file.txt.
If you are using ext2 then you may try recover command.

No comments: