Finding deleted text on a Linux system using Grep | finding deleted text files using grep

I ran across a neat little trick when attempted to recover a deleted file on my Linux box.

You can use grep to search your disk at a bit level for a deleted file, on the condition you know a string in its contents.

You can test it like this, write a text file and store a specific string in it. ie

then insert something like

then delete the file.

Now lets find the deleted file.

Your missing file should appear with a bit of junk above and below the contents of your file.

Increase the lines in the -B10 -A10 depending how big your file it.

 

 

Leave a Reply

Your email address will not be published. Required fields are marked *