Deleting and Recovering Deleted Files In Linux
Deleting Files In Linux
In the graphical environments that come with many modern Linux distributions, deleting a file is as simple as right-clicking the shortcut icon, then clicking the “Delete” option in the context menu. When working from the command console or terminal, the delete command is “rm” for remove. The rm command accepts a number of parameters, some both unsafe and extraordinarily useful. The most famous parameter pair is “rm -rf” and deletes everything, recursively (r), from the specified folder on down. Additionally, the rm command does not ask to confirm each file being deleted (f), meaning a user could possibly erase the entire file system if they were not careful. To top this all off, the ext3 file system used by the majority of Linux distributions is notoriously unforgiving when it comes to accidents.
Where’s My Recycling Bin?
The first question a lot of new Linux users ask is where the recycling bin is hiding. The unfortunate answer (especially if this new user just deleted the document they had been working on) is that there is not one. In fact, there is not a single operating system that actually has a true recycling bin built in. The recycling bin is simply a hidden folder that any document marked for deletion gets moved into. When the folder reaches a certain size, older documents get actually deleted first. Under Linux, this step is skipped and a file is immediately deleted unless the Linux distribution, like many user-centric distributions, has a recycling bin function built-in.
Creating A Recycling Bin
Luckily, Linux is extraordinarily customizable and extensible. To add recycling bin functionality, a user can simply add an alias to their .bashrc file, in a user’s home directory, that overrides the rm command.
alias rm=‘mv –target-directory=$HOME/.Trash’
The alias above would turn the rm command into the mv, move, command and send any files sent to be removed to the .Trash directory in the user’s home folder. While this is not an optimal solution by any means since it overrides the rm command and may cause confusion on other systems, an alias gets the job done. Since both the Gnome and KDE desktop environments now offer trash functionality from the desktop, the only place you should need to add trash service is at the command line.
Data Recovery With File Carving
Like all things with Linux, there are a number of ways to accomplish the same task, but the most user friendly way to recover files is by using a file carving utility. File carving parses a hard disk or disk image for the leading and trailing bits of a file. The carving application then uses those bits to identify the file type and piece together the deleted file on the disk. This is possible only because nothing is ever truly deleted on a hard disk unless the data has been written over multiple times. File carving is a reliable technique for data recovery, and a number of Linux applications (trusted by digital forensics experts and law enforcement agencies) lead the field in carving techniques.
Three main applications lead the file carving field in Linux: foremost, PhotoRec, and scalpel. Though all three run from the command line, they are relatively straightforward in their use. From a terminal emulator, enter the application’s name, followed by the hard drive partition’s name found by using the “fdisk -l” command (ex. /dev/hda2). Optionally, all applications will take additional parameters to save only a certain type of file from your hard disk.
References
Die.net: rm man page, https://linux.die.net/man/1/rm
SuperUser, https://superuser.com/questions/31171/undo-linux-trash-command
This post is part of the series: Linux Recovery Tutorials
Learn how to use the free and open source operating system, GNU/Linux, to analyze, recover, and repair your computer. Using Linux’s free utilities you can fix lost partitions, resurrect deleted files, and repair seemingly unrepairable hard disks.
