grep | Tech Interchange

I ran across a neat little trick when attempted to recover a deleted file on my Linux box.

You can use grep to search your disk at a bit level for a deleted file, on the condition you know a string in its contents.

You can test it like this, write a text file and store a specific string in it. ie

vim /home/username/myfile.txt

1	vim /home/username/myfile.txt

then insert something like

I like cats
I like Dogs
fast cars smell like roses
i like rinos
i like lions.

I like cats

I like Dogs

fast cars smell like roses

i like rinos

i like lions.

then delete the file.

rm /home/username/myfile.txt

1	rm /home/username/myfile.txt

Now lets find the deleted file.

grep -a -B10 -A10 'fast cars smell like roses' /dev/mapper/vg_system-root

1	grep -a -B10 -A10 'fast cars smell like roses' /dev/mapper/vg_system-root

Your missing file should appear with a bit of junk above and below the contents of your file.

Increase the lines in the -B10 -A10 depending how big your file it.

Grep is the number one tool used by linux systems administrators. I rely on this tool everyday, but its used in many different ways. I decided to list my top six uses.

Top use is grep with the recursive switch (grep -r). This is used for searching a particular filesystem path for a particular word. One common reason why I use this switch is when Im searching in a nagios configuration directory for mentions of a hostname. This allows me to find all the locations where a hostname has been mentioned and I can then alter it if needed.

grep -r expression /path

1	grep -r expression /path

This straightforward search allows you to look in a text file and find all the locations where the expression or search word can be found. The results will include the entire line where the expression has been matched.

grep expression /filename

1	grep expression /filename

The will do the opposite from he previous command, this will exclude all mentions of the search criteria. This will remove the entire line from the search results.

grep -v expression /filename

1	grep -v expression /filename

This will match the line but also include a certain number of subsequent lines, the number indicates how many lines after the match you would like included.

grep -A 1 expression /filename

1	grep -A 1 expression /filename

Again this the opposite of the previous command, this will include a certain number of lines before the match line.

grep -B 1 expression /filename

1	grep -B 1 expression /filename

This also proves to be very useful, this will remove case sensitivity from your search string.

grep -i expression /filename

1	grep -i expression /filename

Tech Interchange

Tag Archives: grep

Finding deleted text on a Linux system using Grep | finding deleted text files using grep

Top 6 common uses for grep | top six uses for grep linux systems administration centos redhat

Projects, products and howtos