Linux Tips

I deleted a file 5 minutes ago and there's no backup. Can I recover?

- by John Britto - Leave a Comment - 1 min read
Quick Linux Tip #47:

Try: sudo debugfs -R 'lsdel' /dev/sda1 | tail -20

Info: debugfs is a low-level ext filesystem tool. lsdel lists deleted inodes, and dump <inode> <file> restores content. Works only if blocks haven't been overwritten yet.

Examples:

  • $ sudo debugfs /dev/sda1  # Interactive filesystem mode
  • $ sudo extundelete --restore-all /dev/sda1  # Automated bulk recovery tool
  • $ sudo photorec  # Universal block recovery across any filesystem

Note: Stop writing to the partition immediately after deletion to prevent overwriting raw blocks. debugfs is specific to ext2/3/4.




LinuxTeck.com 
linuxteck@ubuntu:~$ sudo debugfs -R 'lsdel' /dev/sda1 | tail -20
debugfs 1.46.5 (30-Dec-2021)
Inode    Owner  Mode      Size    Blocks   Time deleted
524290   1000   100644    234567  57/57    Tue Aug 10 15:23:45 2026
524291   1000   100644    45678   12/12    Tue Aug 10 15:24:12 2026
524292   1000   100644    890123  217/217  Tue Aug 10 15:25:33 2026

linuxteck@ubuntu:~$ sudo debugfs -R 'dump <524290> ./recovered.dat' /dev/sda1
debugfs 1.46.5 (30-Dec-2021)

linuxteck@ubuntu:~$ ls -la ./recovered.dat
-rw-r--r-- 1 root root 234567 Aug 10 15:28 ./recovered.dat
linuxteck@ubuntu:~$

PREVIOUS ARTICLE Quick Linux Tip #46: I'm about to make risky changes. How do I create a rollback point? NEXT ARTICLE Quick Linux Tip #48: How do I quickly share files across my network without setting up nginx?
About John Britto

John Britto Founder & Chief-Editor @LinuxTeck. A Computer Geek and Linux Intellectual having more than 20+ years of experience in Linux and Open Source technologies.

View all posts by John Britto →

Leave a Reply

Your email address will not be published.