Recovering a deleted file on Linux: A guide by someone who had too

So the other day while trying to mess around with LLVM’s polly I ran this command

sudo rm /etc/portage/make.conf

I meant to launch neovim but in my haste and some arrow magic I deleted my make.conf this basically tells gentoo how to build my system. Without it, basically its like starting from scratch, very not fun. So how do you recover from a similar situation

Step 1: Shut Down

Shut down your system. As quickly as possible we want to shut down your system, prevent some process from writing to the disk possibly. Depending on your filesystem this could be the if you recover any files or if you lose everything.

Step 2: Plan

Now you’ve done that we can start to look into saving your files. Your filesystem choice now plays an important role. If you had a copy on write(CoW) filesystem, you can start praising your filesystem developers, they’ve just saved you, you can guarantee that you can recover files. If you chose a non-CoW file eg EXT4 not all hope is lost but the likelihood of everything being recovered is lower but if you did shutdown your system ASAP. You have a high chance of recovery.

We now need to start setting up a live USB to recover your files. You need to choose an operating system to build your system. I recommend SystemRescue as it comes preinstalled with a large set of utilities including a few we will use. You will also need to get a storage device with enough or more capacity than the files you need to recover.

Step 3: Recover

Now its time to recover your files. If your on a journaling file system you can use TestDisk or PhotoRec. This are utilities bundled with SystemRescueCD.

If your on btrfs I recommend using btrfs-undelete a script that uses btrfs restore to restore files for you, unlike PhotoRec it can target specific files. There will be similar scripts/utilities for you file system if it is Copy on Write.

TLDR: CoW for life

2 Likes

I forgot to mention, PhotoRec is also available on windows and it supports NTFS the default file system of windows.