4

I accidentally deleted a directory with

rm -rf /media/directory

When using

ls -lh /media

the space appears to be free, but when I use df or open the file manager nautilus or pantheon, it shows that the previously occupied space is still allocated.

I googled this problem and some says that some process is still using these data, so it won't be freed till unmount, restart or killing the process itself. I did none of these still, is there any way to recover it?

MarianD
  • 1,028
xquilt
  • 117
  • I did this too before, (sometimes must be the first one I guess?) Try a tool named foremost, to recover some files as a shortcut here: foremost -v -t <dir to recover or /device> I THINK I can be wrong, it was long ago I used foremost but I think that's it ; Hope it fixes itself! good luck - It's never fun to accid. delete stuff, trust me I've been there. – William Martens Dec 05 '20 at 15:08
  • i opened the computer to solely backup the directory that i deleted with rm -rf – xquilt Dec 05 '20 at 15:18
  • The best thing to do is stop using the computer now, logout and boot up with a live USB or DVD and recover the files using foremost or testdisk / photorec (photorec recovers more than just photos). Ideally, it would be best to also have a spare USB storage device to dump the files onto. Using testdisk or photorec, the files (or pieces of the files that are left) will no longer have the original file names but the actual data (deleted files) may be recovered from the available free space (Select a directory on the USB storage for the recovered files). – mchid Dec 05 '20 at 16:53
  • I usually use photorec (which is included in the testdisk package) to recover deleted files and I select all the filetypes but I believe testdisk is supposed to be capable of undeleting files or at least recovering deleted files from the free space of the specified partition. See here for more information. – mchid Dec 05 '20 at 17:06
  • Please let us know if this answer does not answer your question and why (again, I suggest doing this from a live USB and using another USB or other storage device to recover the files to, you may need a lot of space as this may recover lots of previously deleted data. If you know the filetypes you are looking for, you can narrow the search down with photorec to limit the filetypes). – mchid Dec 05 '20 at 17:09
  • primarily text files and pdfs – xquilt Dec 05 '20 at 17:13
  • Also, take a look at these various answers to your question. Although again, I can't stress enough how important it is to run the recovery from a USB live session so you don't overwrite any of the deleted data. – mchid Dec 05 '20 at 17:16
  • 1
    i wanna keep my computer up , as i aforementioned some people say there is a process using it , and that's why both the file managers and df is still reading the previously occupied space .... i was wondering if there is a way to recover the data instead of typical recovery – xquilt Dec 05 '20 at 17:19
  • @mostafa Okay, I see what you are saying; this is a good question. – mchid Dec 05 '20 at 17:27
  • @mostafa However if absolute recovery is most important, you might want to try one of those methods. – mchid Dec 05 '20 at 17:29
  • @mostafa I think this is the answer you are looking for but I have never tried this myself. lsof was the first thing I thought of because it shows what files are in use which is how I found the answer. – mchid Dec 05 '20 at 17:38
  • If you use this lsof method, I think it would be safest to use to output the recovered files to a separate storage device if possible. Here is another example. – mchid Dec 05 '20 at 17:44
  • when i accidentally delete the /media directory which contains another directory where i mount /dev/sda5 partition .... it indicated that it can't delete it's in process ... but its files were already gone because of the f ... that's the exact scenario of what happened ... i was wondering if it has something to do with the mount point not the device file – xquilt Dec 05 '20 at 17:45
  • i used lsof to detect one of the files ... that was the output

    lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs Output information may be incomplete.

     – xquilt Dec 05 '20 at 18:01
  • @mostafa That doesn't look like the file. Try lsof | grep deleted – mchid Dec 05 '20 at 18:05
  • @mostafa If you don't see any of the actual filenames listed, then you will have to use a different method like photorec or testdisk. If you remember any of the filenames, you can search for the specific file by using grep with lsof. For example, to search for a file named "awesome.pdf" you could use lsof | grep 'awesome.pdf' or you could search for directory: lsof | grep '/media/' If the actual files don't list after you run the command, then you will have to use foremost or photorec, preferably from a live USB session. – mchid Dec 05 '20 at 18:21
  • i tried this method of recovering the files with lsof and /proc ... turned out to be that it only works if the files is being opened by some program like for instance nano or less is processing on the file .... and you opened another window and removed it then this method will definitely work ... but i had none of the deleted files opened by another process yet they somehow still exist – xquilt Dec 05 '20 at 19:22
  • @karek i did try testdisk out , but it only recovered the file names , like for instance i had multiple text files it recovered the file itself being empty – xquilt Dec 06 '20 at 19:40
  • photorec did retrieve only some text files in a splitted separates files , had to use cat and export them somewhere .... and used testdisk to get the only the name of the deleted files / directories – xquilt Dec 07 '20 at 04:26

0 Answers0