1

I was working in the terminal and I accidently deleted a directory by "rm -rf"

Is there any utility which can recover files deleted via unix commands?

2
  • You will have a far better chance with any recovery utility if you deleted them from a hard disk rather than an SSD. The more you have used the drive since you did it, & the smaller it is, the lower the chances.
    – Tetsujin
    Dec 10, 2015 at 8:09
  • Your title says can I recover directories - are you asking if you can reconstruct the exact layout that existed or just the normal "run a program to troll all the "free space" to see if it can find the files and throw them all in a folder named "recovered files".
    – bmike
    Dec 10, 2015 at 14:27

3 Answers 3

4

The short answer: No. The long answer: You could try to use data recovery utilities on the drive, as it generally just marks the space as freed for other things to rewrite over.

1

It is possible for files and even entire directories to be recovered after deleting them, as long as you haven't used the drive to store too many things or edited too many files since then.

The reason for that is files are stored on hard drives in the same way that old library card catalogs were stored: each book had its card and with the card, you could find the book. Without the card, it wasn't easy to find the book.

Similarly, to save time when deleting a file or even a directory, computers just delete the pointer to the file rather than the entire file. Meaning that the file is still out there, just not easily seen, since the pointer, the card catalog entry is missing. Unfortunately, because there is no catalog entry for the deleted files, the space occupied by the newly invisible files is marked as available and any actions that write to that space risk erasing those files permanently.

To get the file back, as was previously mentioned, you can use undelete tools, such as Boomerang, to scan the hard drive for files that are missing file system entries in the "catalog". The undelete tool will then locate any deleted files and then recreate the original file system entries, making the files visible.

I just noticed you asked for Unix commands, my bad. I don't know of any Unix commands, but as you've seen there are a number of GUI-based undelete tools, like boomerang, that you might use.

1

First check your Time Machine Backup. The file is probably still there.

If don't have a Time Machine Backup or that folder wasn't backed up, you can use one of many third party tools to try and retrieve the files. Prosoft Data Rescue, Disk Warrior, EaseUS Data Recovery, FileSalvage, Disk Drill, PhotoRec.

Avoid writing new data, so the deleted sectors aren't overwritten. So ideally shut the computer down and use a different computer or boot drive to get the data recovery tool.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .