Undo the Linux trash command

24

13

Can we undo operations done in a terminal, for example, file deletion through rm?

Solutions obtained:

  1. Aliasing
  2. Undelete utilities
  3. Backup utilities
  4. LibTrash
  5. Versioning (FUSE)

cdb

Posted 2009-08-28T06:00:23.187

Reputation: 989

1

On rm: It unlinks a file from it's inode. The question: "Where do files go when the rmcommand is issued" -> http://unix.stackexchange.com/questions/10883/where-do-files-go-when-the-rm-command-is-issued might also be a good read for you.

– erch – 2013-12-08T15:52:19.040

Answers

62

There is no general "undo" for every operation in terminal.  If you wish to recover a file after using rm you will need to look into recovery software.

An option to prevent you from future mistakes is to make aliases for alternative commands to remove files.  Add them to your ~/.bashrc and get into the habit of using them instead of rm.

  1. alias rmi='rm -i'

    If you use rmi, you will be prompted for confirmation of future deletes.  Try to avoid developing the habit of pressing y immediately after you issue an rmi command, as that will defeat the purpose.

  2. You could also move files deleted by the trsh command in terminal to your recycle bin (on KDE and Gnome):

    alias trsh='mv --target-directory="$HOME/.Trash"'

    If you use trsh, you will have a limited "undelete" capability.  Beware that

    trsh dir1/file1 dir2/file1

    may still cause unrecoverable data loss.

John T

Posted 2009-08-28T06:00:23.187

Reputation: 149 037

3+1 for a much better answer than mine =) – The How-To Geek – 2009-08-28T06:27:35.677

9the second alias is very, very smart. +1. – LiraNuna – 2009-08-28T07:58:17.457

How do you do this on a Mac? ~./Trash is the trash, but mv doesn't have the target-directory switch... – Rich Bradshaw – 2009-08-28T11:02:43.857

1@Rich: you can define a function: rm() { rm $* ~/.Trash } – mouviciel – 2009-08-28T12:29:16.833

3trash() { mv $@ ~/.Trash; } # bash function, not an alias.

Changing the expected behavior of rm is a bad idea, IMHO. – Richard Hoskins – 2009-08-28T12:43:03.467

Yeah, I wouldn't have overloaded rm - I guess this doesn't support -r or -f flags, so it's not identical. – Rich Bradshaw – 2009-08-29T08:37:38.983

20The risk with aliasing rm to rm -i is that you get used to the safety net that it gives you. Then you go onto another machine, which doesn't have that alias... – Dentrasi – 2009-08-29T09:35:59.147

3For the reasons that Richard and Dentrasi mention, I prefer to create a custom function or to alias rmi -> rm -i. It's really a mistake to simply get in the way of an existing program by aliasing over it. – Telemachus – 2009-08-31T02:15:20.213

1I'd not recommend aliasing rm as a safe or good solution, especially not the alias to mv. It just promotes false security. What do you think happens when you delete file1 in dir1 and then file1 in dir2? It also wouldn't work for people (or scripts) like me who're habituated to run \command instead of command. You should recommend explicitly using a command like trsh/trash instead or rm if undelete facility is required. – None – 2009-08-31T09:31:51.097

2People seem to be a little flustered over the aliasing issue. When I use another persons system the first thing on my mind is that all my little programs and shortcuts are gone, so it isn't really an issue for me. But I will edit. – John T – 2009-08-31T16:07:40.303

1@John: not a huge deal, but saying we're "flustered" makes us sound like lost tourists. We disagree with your original method, and we gave reasons why. There's no fluster. (That said, I removed my downvote, since you switched to rmi. Thanks for seriously considering the comments.) – Telemachus – 2009-08-31T19:59:27.543

@John: Thanks for the edit. It'll hopefully nudge folks in the right direction. +1 from me. – None – 2009-08-31T23:43:14.783

1I wouldn't recommend rm -i either, not because of other systems, but simply because it trains you to hit y really quickly after you called rm. Thus it provides no extra safety, as most of the time you will only realize the second after you hit y that this wasn't such a good idea. – Grumbel – 2009-09-09T16:00:03.303

i am with grumbel here: avoid the alias 'rm -i' because you quickly will develop the habit of pressing 'y' .. just automatically. the trash() function is much smarter. i have my /tmp mounted as tmpfs (ramdrive) .. so i point my trash() towards /temp. if i made a mistake, i recover it .. if not, the next reboot will wipe it all away. there is a size-limit for what fits into that 'trahs' obiously :) – akira – 2009-09-24T19:43:36.620

1I always have rm, mv, and cp aliased to add -i. It's most useful for mv and cp, because you usually don't mean to clobber anything with them. Never get in the habit of running rm * and then answering yes/no. As others have said, some day that safety net won't be there and you'll regret it. – Peter Cordes – 2009-12-12T04:22:03.310

6

There is no recycle bin for the command line.

You could try some of the various undelete utilities, but there's no guarantee that they would work.

The How-To Geek

Posted 2009-08-28T06:00:23.187

Reputation: 5 482

Trash-cli is so good :) and uses Trashlib, better than simply moving files. – m3nda – 2016-01-11T22:15:15.307

Yes, there is a trash for the command line. See trash-cli in another answer. – Sparhawk – 2014-02-28T04:19:18.570

5

You could use trash-cli if you use KDE when you run a gui. This is command line utility to delete/restore using the KDE trash facilities.

joe

Posted 2009-08-28T06:00:23.187

Reputation: 91

Don't forget to alias rm=trash so that your typical command-line screw-ups come with undo buttons. – Ryan C. Thompson – 2010-02-19T23:25:03.100

1trash-cli provides also works with GNOME trash and it's designed to provide rm options compatibility (for the aliasing). – Andrea Francia – 2009-12-02T08:04:56.647

I think alias rm=trash is potentially dangerous, if there is any chance you will use someone else's system one day and forget (or ssh). Much safer to just get used to writing trash instead of rm. – Sparhawk – 2014-02-28T04:20:21.247

4

You could make rm an alias for the trash command (You will need to install trash first.) Add this to your ~/.bashrc :

alias rm='trash'

This is preferable to alias rm='mv --target-directory=$HOME/.Trash' since ~/.Trash is NOT the trash folder for gnome. It is better IMHO to let trash figure out where the actual trash folder is.

btw I would have posted this in a comment but I don't have enough rep.

Alvin Row

Posted 2009-08-28T06:00:23.187

Reputation: 595

'rmtrash' is another option. – Itachi – 2015-06-12T06:10:39.220

5+1 for "since ~/.Trash is NOT the trash folder for gnome." However, rm shouldn't be aliased to trash either. You should just use trash instead of rm if that's what you want. – None – 2009-08-31T09:35:21.853

True, but for some people old habits die hard. – Alvin Row – 2009-08-31T15:50:21.540

3

There's a larger question here that's worth addressing. Shell commands are not chatty (they don't double check what you want), and they expect you to know what you're doing. This is fundamental to how they are designed. It's a feature, not a bug.

Some people feel macho when they use such commands, which I think is pretty silly, but it is important to understand the dangers. You can do a great deal of damage in a terminal, even if you're not root. I think you probably really just cared about rm, but since you said "Can we undo the the operations done in terminal", I thought this was worth saying. The general answer is no, you can't.

Telemachus

Posted 2009-08-28T06:00:23.187

Reputation: 5 695

3

Two more technical solutions have not be named yet:

  1. libtrash: A dynamic library which can be preloaded in your shell which intercepts the deleting/removing syscalls and moves the files to a trash folder instead (much like an alias but works for any application when preloaded).
  2. A versioning file system. If you delete (or edit, or copy, or ...) a file, you can just revert to an old state. This could be done with a FUSE filesystem and one of its versioning filesystems.

joschi

Posted 2009-08-28T06:00:23.187

Reputation: 981

2

Option 1: See Undelete Linux Files from an ext2 File System. This page points to a program, written by Sebastian Hetze of the LunetIX company, that (as the title suggests) undeletes recently deleted files from an ext2 filesystem. Example usage:

# undelete -d /dev/hdc3 -a 10

Warnings:

  • The original web site is gone. The link, above, is to the Internet Archive.
  • The site(s) are in a mixture of English and German.
  • As stated above, the tool is designed specifically for the ext2 filesystem. It is unlikely to work on any other filesystem type; especially not ones other than extN.

Option 2: I have rsnapshot (rsync) running on my machine which makes snapshots hourly of my selected folders. It incrementally does this every hour, 2 hours or whatever you tell CRON to do. After a full day it recycles these snapshots into one daily snapshot and after 7 days in a weekly so on and so on. This makes me able to go back in time for about a month or so for every hour! It is pretty good with disk space as it creates symbolic links to files which never changed...

Pit

Posted 2009-08-28T06:00:23.187

Reputation: 882

Just to clarify, #1 is specific to ext2 filesystems. It wouldn't work on an ext3 filesystem. – None – 2009-08-31T09:35:59.887

1

Recover using grep on /dev/partition (Linux or Unix Recover deleted files – undelete files),

grep -b 'search-text' /dev/partition > file.txt

Just a try.

cdb

Posted 2009-08-28T06:00:23.187

Reputation: 989

1

There exist undelete utilities for ext2, but most other Linux filesystems are stuck in the Stone Age and don't have any advanced usability features. Sad state of affairs considering gigantic drives with enough space to never delete a file again are commonplace.

So you are stuck with three options:

  1. Do backup regularly, for example with a command like:

    rsync -axvRP --backup --backupdir=/backup/incr/$(date -I) /home/ /backup/root/

  2. Use a version control tool such as git for all your work. While this will not protect against against a crazy rm -r that kills the repository, it will protect against regular troubles as you will be using git rm not raw rm.

  3. Be extra careful and don't trust too much in rm -i, trash-cli and friends, as most data you will lose on the shell you will not lose by accidental rm, but by misdirected pipes, mistyped output files, misdirected mv and stuff, i.e., things that will overwrite your data, not just delete it.

Do all three for maximum amount of safety.

Grumbel

Posted 2009-08-28T06:00:23.187

Reputation: 3 100

It's pretty hilarious to call ext2 modern. The newer filesystems use more complicated on-disk formats than ext2/3, and had to give up easy-to-find locations where you might find files to un-delete. They're designed for people who make backups of things they care about. BTW, I always use mv and cp -i, since I don't normally want to clobber anything. I normally type \rm, because I have rm aliased to rm -i, too, but I don't want to answer its question. – Peter Cordes – 2009-12-12T04:19:45.623

0

For me (opensuse leap 42.2, NTFS pendrive) PhotoRec - also by testdisk creators - worked :) However it haven't recover file names.

PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file system has been severely damaged or reformatted.

I've installed it using standard repositories in openSUSE

instruction

boczniak767

Posted 2009-08-28T06:00:23.187

Reputation: 1

1

Welcome to Super User! Please read How to recommend software for minimum required information and suggestions on how to recommend software on Super User. To keep your answer useful even if the provided link(s) breaks these details should be edited into your answer.

– I say Reinstate Monica – 2017-05-02T13:01:54.210

0

check this ... migh be helpful http://artmees.github.io/rm/

suppose you did

rm very_important_file

from the terminal. recovering this file is a tedious and not always successful process

instead if you used the script mentioned up. you don't have to worry about this because

rm very_important_file
mv very_important_file ~/.Trash/

are equivalent. the script handles more cases and doesn't alter your system rm at all and that is because it's put into the user local bin folder so it shadows the system rm and yet doesn't affect it or disable using it

this is a refined aliasing approach but without losing any feature

a14m

Posted 2009-08-28T06:00:23.187

Reputation: 119

1It'd be good if you could add some explanation as to what this does and how it applies to the question, maybe add an example, etc. – slhck – 2013-12-07T12:24:25.797

0

TestDisk can undelete files from FAT, exFAT, NTFS and ext2 filesystems.

Cristian Ciupitu

Posted 2009-08-28T06:00:23.187

Reputation: 4 515

Asked: 2009-08-28T06:00:23.187

Viewed: 25 356 times

Active: 2017-05-02T19:45:49.250