Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to list recently deleted files from a directory?

I'm not even sure if this is easily possible, but I would like to list the files that were recently deleted from a directory, recursively if possible.

I'm looking for a solution that does not require the creation of a temporary file containing a snapshot of the original directory structure against which to compare, because write access might not always be available. Edit: If it's possible to achieve the same result by storing the snapshot in a shell variable instead of a file, that would solve my problem.

Something like:

find /some/directory -type f -mmin -10 -deletedFilesOnly

Edit: OS: I'm using Ubuntu 14.04 LTS, but the command(s) would most likely be running in a variety of Linux boxes or Docker containers, most or all of which should be using ext4, and to which I would most likely not have access to make modifications.

like image 581
Marco Roy Avatar asked Aug 07 '15 17:08

Marco Roy


People also ask

How do I recover a deleted file from a specific folder?

Right-click the file or folder, and then select Restore previous versions. You'll see a list of available previous versions of the file or folder. The list will include files saved on a backup (if you're using Windows Backup to back up your files) as well as restore points, if both types are available.

Where are recently deleted files stored?

When you delete a file or folder, it goes into the Recycle bin, where you have a chance to restore it.

How do I find recently deleted files in Windows Explorer?

To Restore That Important Missing File or Folder:Type Restore files in the search box on the taskbar, and then select Restore your files with File History. Look for the file you need, then use the arrows to see all its versions. When you find the version you want, select Restore to save it in its original location.

How do I find recently deleted files in Windows 10?

If you can’t see the Recycle Bin icon on the desktop area, please refer to how to add the Recycle Bin icon to the Windows 10 desktop guide. Step 2: Right-click on the empty area, click Sort by and then click Date deleted. That’s it! You can now see all recently deleted files with the deleted date next to each file.

How to recover deleted files with date next to each file?

That’s it! You can now see all recently deleted files with deleted date next to each file. To restore a file, simply right-click on a file and then click Restore option to restore the file to its original location. If you want to restore multiple files at once, simply select files that you want to restore, right-click and then click Restore option.

How to recover deleted files without software in Windows 11?

Windows 11 comes with a slightly redesigned Recycle Bin that functions just like the Recycle Bin in Windows 10, allowing you to undelete recently deleted files without software: Double-click the Recycle Bin icon on your Desktop. Select the files you want to recover. Right-click any of the selected files and choose the Restore option.

How to recover deleted folders from computer hard disk?

With Recoverit Data Recovery software, it can easily to recover deleted folders from computer hard disk, also, the file recovery software can recover deleted files from external hard drive device.


2 Answers

You can use the debugfs utility,

debugfs is a simple to use RAM-based file system specially designed for debugging purposes

First, run debugfs /dev/hda13 in your terminal (replacing /dev/hda13 with your own disk/partition).

(NOTE: You can find the name of your disk by running df / in the terminal).

Once in debug mode, you can use the command lsdel to list inodes corresponding with deleted files.

When files are removed in linux they are only un-linked but their inodes (addresses in the disk where the file is actually present) are not removed

To get paths of these deleted files you can use debugfs -R "ncheck 320236" replacing the number with your particular inode.

Inode   Pathname
320236  /path/to/file

From here you can also inspect the contents of deleted files with cat. (NOTE: You can also recover from here if necessary).

Great post about this here.

like image 139
nextstep Avatar answered Nov 06 '22 09:11

nextstep


So a few things:

  1. You may have zero success if your partition is ext2; it works best with ext4

  2. df /

  3. Fill mount point with result from #2, in my case:

    sudo debugfs /dev/mapper/q4os--desktop--vg-root

  4. lsdel

  5. q (to exit out of debugfs)

  6. sudo debugfs -R 'ncheck 528754' /dev/sda2 2>/dev/null (replace number with one from step #4)

like image 37
E L Avatar answered Nov 06 '22 10:11

E L