SHELL

linux recover deleted file

#!/bin/bash

# sometimes I can recover deleted files with this script
if [[ ! $1 ]]; then
    echo -e "Usage:

	$0 'file name'"
    exit 1
fi

f=$(file 2>/dev/null /proc/*/fd/* | awk '$NF == "(deleted)"{print $(NF-1)}')

if [[ $f ]]; then
    echo "fd $f found..."
    cp -v "$f" "$1"
else
    echo >&2 "No fd found..."
    exit 2
fi

# There's another useful trick: if you know a pattern in your deleted files, type alt+sys+resuo to reboot+remount in read-only, then with a live-cd, use grep to search in the hard-drive
grep -a -C 500 'known pattern' /dev/sda | tee /tmp/recover