How to find deleted files in Linux?

Finding Deleted Files in Linux: A Comprehensive Guide

Linux is a powerful operating system that comes with various file systems, includingextensible file systems (XFS), ext2, and ext3. When a file is deleted, it is removed from the file system, but if it has been copied to another location, such as an external hard drive or a cloud storage service, the original file may still exist. Finding deleted files in Linux can be a tedious task, but it is an essential skill for system administrators and users alike. In this article, we will explore the steps to find deleted files in Linux.

Understanding File System Metadata

Before we dive into the solution, it’s essential to understand the file system metadata that contains information about deleted files. File system metadata includes:

• File type and modification date
• File permissions and access control lists (ACLs)
• File flags and permissions
• File name and path information

To find deleted files, you need to examine the file system metadata. Here are some ways to do it:

• Use the ls command: The ls command is a powerful tool that allows you to list files and directories in a file system. You can use the --file-type option to include file type information in the output.
• Use the find command: The find command is a powerful search utility that allows you to search for files based on various criteria, including file type, modification date, and permissions.

Finding Deleted Files Using the find Command

Here are some ways to use the find command to find deleted files in Linux:

• Find files with a specific type: You can use the --type option to filter the output by file type. For example:

  • find / -type f -name "example.txt"

• Find files with a specific modification date: You can use the --mtime option to filter the output by modification date. For example:

  • find / -mtime -10 -type f -name "example.txt"

• Find files with a specific permissions: You can use the --perm option to filter the output by file permissions. For example:

  • find / -perm -200 -type f -name "example.txt"

Command	Description
find / -type f -name "example.txt"	Finds files with a type of f (regular file) and a name of "example.txt"
find / -mtime -10 -type f -name "example.txt"	Finds files with a mtime of -10 and a type of f (regular file) and a name of "example.txt"
find / -perm -200 -type f -name "example.txt"	Finds files with a perm of -200 (unsafe permissions) and a type of f (regular file) and a name of "example.txt"

Finding Deleted Files Using the fsck Command

Here are some ways to use the fsck command to find deleted files in Linux:

• Check for file system errors: The fsck command is used to check for file system errors and can be used to find deleted files. To check for errors, use the following command:

  • fsck -F

• Find files with a specific error type: You can use the --error option to filter the output by file system error type. For example:

  • fsck -F -t ext4 -e

Command	Description
fsck -F	Checks for file system errors and finds deleted files
fsck -F -t ext4 -e	Finds files with a t file system type (ext4) and an e error type (in this case, disk write errors)

Finding Deleted Files on External Devices

If you have deleted files on an external device, such as an external hard drive or a cloud storage service, you can use the find command to find the deleted files. To do this, use the following command:

• find /media/external_storage -type f -name "example.txt"

  • Use the dd command: The dd command is a powerful tool that allows you to read or write data to a device. You can use the dd command to find deleted files on an external device. To do this, use the following command:

• dd if=/dev/zero of=/media/external_storage/bandwidth_bound_log bs=1 seek=1024 count=1000

Command	Description
find /media/external_storage -type f -name "example.txt"	Finds files with a type of f (regular file) and a name of "example.txt" on an external device
dd if=/dev/zero of=/media/external_storage/bandwidth_bound_log bs=1 seek=1024 count=1000	Finds deleted files on an external device by reading data from the beginning of the device and writing it to a log file

Conclusion

Finding deleted files in Linux requires some basic knowledge of the file system and metadata. By using the find command and exploring the file system metadata, you can find deleted files in Linux. Additionally, using tools like fsck and dd can help you identify deleted files on external devices.