Recovering files after rm in Linux

This is in brief how I recovered 20+ files I had lost after an accidental ‘rm’. It was simpler than I expected.

My case

System: Ubuntu

Time I started recovery: 1 hour after having done ‘rm’

Files recovered: html, css, .py

How to

Run `df` to find out which drive the files are in. Eg. /dev/sda1, or /dev/sd6

`sudo vim /etc/foremost.conf` You will see various file formats and need to uncomment the ones you want. In my case I needed to add .py files. For .py files you need to specify how the files usually start, so I used the “import” expression as a match. For html files you can use the “” tag or something of the sort.

`sudo foremost -i /dev/sda6 -o recovered_files` (-o is for the directory to where you want to output the recovered files). This will start running and go on for a while trying to recover as many deleted files as it can find. In the meanwhile you can do the next step

Look inside the recovered_files folder. Here there should be a directory for each file extension you are looking for. In my case I find a py, html, and css folder. Inside each of those folders you will find hopefully numeric file names with the extensions. (Eg. 2342344.py). These are the recovered files.

`find recovered_files/py/ -type f -print0 | xargs -0 grep “class UserProfile:”` This is so that we can narrow it down to the files we want from the recovered files. We cannot use a regular grep because there might be too many files and you will get: /bin/grep: arg list too long

For more details checkout the foremost tool.