Is there any way to restore deleted files from Unix, BSD and Solaris?
Most users of UNIX and UNIX-based operating systems, like BSD and Solaris, find it more convenient to delete files and directories from the command line: the rm command followed by the -r option provides an easy and quick way of removing items, especially when a large number of similar files is involved. However, this method poses a higher risk of mishaps, as the OS won’t ask for confirmation before carrying out the command and will immediately get rid of the files instead of placing them to the Trash folder. Other options are usually more secure but, unfortunately, none of them can entirely protect the user from accidental deletion of important information which results in the urgent need to recover deleted files.
Thankfully, even if a certain file is marked as deleted and cannot be accessed by any standard means, its data blocks and some of its attributes remain of the disk until overwritten by other information. The chances for survival of deleted data depends mainly on the amount of subsequent write activity and the methods chosen to restore deleted files.
Recover deleted files from the file systems of UNIX, OpenBSD, NetBSD, FreeBSD, Solaris
The major file systems employed in the UNIX environment are UFS (UFS2) and ZFS, although more and more systems make use of ones borrowed from the Linux family. Each of them has its own algorithms of file deletion described in Peculiarities of data recovery depending on the OS which determine the techniques used by data recovery software to restore deleted files and influence the quality of the obtained results. Still, from the perspective of the user, the steps performed to retrieve deleted data won’t significantly differ from data recovery on Linux.
SysDev Laboratories recommends UFS Explorer Standard Recovery as an effective software solution which works with UFS (UFS2) and all of the most popular Linux file systems as well as both simple and stripe ZFS volumes.
Note: Recovery of deleted files is possible as long as they are not overwritten with some other information. For this reason, it is highly recommended to stop all operations with the storage from which the data has been deleted and immediately start recovering files.
Note: If the files were deleted from a solid state drive (SSD) with enabled TRIM, their contents are very likely to have been wiped by the command invoked right after deletion. Successful recovery of such files is usually beyond the bounds of possibility.
- In order to prevent overwriting of deleted files by some user or process, switch the system to a single-user mode and unmount the file system of the problem directory by running the “unmount” command with the name of the disk or the mount point. As the "/root" directory cannot be unmounted, if the deleted data was stored there, is strongly recommended to remove the drive from the computer and connect it to another machine as a secondary storage.
- Download the installation file of UFS Explorer Standard Recovery choosing the “Download for Linux” option, extract the content of the downloaded archive and launch the installer after entering your user password. Refrain from using the partition from which you want to restore deleted files as any writes to it may lead to their destruction.
Note: To run UFS Explorer Standard Recovery, your operating system needs to have an X-Server (X11) and the necessary shared libraries. In case of installation failure, execute the ldd command to check which libraries are missing and install them.
- Run the application and, if necessary, modify the program settings which can be found in the settings pane.
- UFS Explorer Standard Recovery automatically recognizes available partitions and displays them in the storages list located in the left pane. Choose the needed partition based on its size, file system type or content and scan it for lost data using the “Scan this storage” tool from the toolbar, the “Start scan” button or the corresponding option in the storage context menu.
- Define the optimal scan parameters. If you want the procedure to be completed faster, you may deselect all file systems except the one applied on your partition and disable InelliRAW. After that, click “Start scan” and wait until the process is finished.
- Browse through the found files and folders. They can be sorted by name, date, type or previewed in the internal viewer. Quick and advanced search options may also help if you need to find specific files.
- Press the “Define selection” button, select the files and folders to be recovered and click “Save (recover) selection”. Choose another partition/disk or a network location to copy the files.
Note: If the data was lost from the "/root" directory and there is no possibility to extract the drive and attach it to another computer or some of the components needed to work with the software are missing in your operating system (an X-server, libraries, etc.), you can boot the machine using UFS Explorer Backup and Emergency Recovery CD for safe data recovery. For more details, please, refer to Data recovery from a system partition.
Last update: April 24, 2019