Is there any way to restore deleted files from Unix, BSD and Solaris?

Most users of UNIX and UNIX-based operating systems, like BSD and Solaris, find it more convenient to delete files and directories using the rm command from the command line. When followed by the -I, –r, or -f  option, it allows speeding up the process of removing items, especially when numerous similar files are involved. However, this method poses a higher risk of mishaps. The thing is that the OS won’t ask for confirmation before deleting each file and will immediately get rid of them. Other options are usually more secure but, unfortunately, none of them can entirely protect the user from accidental deletion of important information.

Once the mistake becomes evident, an urgent need may arise to recover deleted files. Thankfully, their data blocks and some of their attributes remain on the storage until overwritten by other information. They simply get marked as deleted and cannot be accessed by any standard means. The chances for recovery of deleted data depend mainly on the amount of subsequent write activity and the methods chosen to restore deleted files.

Recover deleted files from the file systems of UNIX, OpenBSD, NetBSD, FreeBSD, Solaris

The major file systems employed in the UNIX environment are UFS (UFS2) and ZFS, although more and more systems make use of ones borrowed from the Linux family. Each of them has its own algorithms of file deletion described in Peculiarities of data recovery depending on the OS. These specificities determine the techniques used by data recovery software to restore deleted files and influence the quality of the obtained results. Still, from the perspective of the user, the steps performed to retrieve deleted data won’t significantly differ from data recovery on Linux.

SysDev Laboratories recommends UFS Explorer Standard Recovery and other UFS Explorer products as effective software solutions that work with UFS (UFS2) and all of the most popular Linux file systems as well as both simple and stripe ZFS volumes.

Note: Recovery of deleted files is possible as long as they are not overwritten with some other information. For this reason, it is highly recommended to stop all operations with the storage from which the data has been deleted and immediately start recovering files.

Note: If the files were deleted from a solid state drive (SSD) with enabled TRIM, their contents are very likely to have been wiped by the command invoked right after deletion. Successful recovery of such files is usually beyond the bounds of possibility.

  1. In order to prevent overwriting of deleted files by some user or process, switch the system to a single-user mode and unmount the file system of the problem directory by running the "unmount" command with the name of the disk or the mount point. As the "/root" directory cannot be unmounted, if the deleted data was stored there, it is strongly recommended to remove the drive from the computer and connect it to another machine as a secondary storage.

    Hint: Please rely on the instructions if you need to attach your hard disk drive to the motherboard or сonnect the HDD externally using a USB to SATA/IDE adapter.

  2. Download the installation file of UFS Explorer Standard Recovery by choosing the "Download for Linux" option, extract the content of the downloaded archive and launch the installer after entering your user password. Refrain from using the partition from which you want to restore deleted files as any writes to it may lead to their destruction.

    Note: To run UFS Explorer Standard Recovery, your operating system needs to have an X-Server (X11) and the necessary shared libraries. In case of installation failure, execute the ldd command to check which libraries are missing and install them.

  3. Run the application and, if necessary, modify the program settings which can be found in the settings pane.
  4. UFS Explorer Standard Recovery automatically recognizes available partitions and displays them in the storages list located in the left pane. Choose the needed partition based on its size, file system type or content. Scan it for lost data using the "Scan this storage" tool from the toolbar, the "Start scan" button or the corresponding option in the storage context menu.
  5. Define the optimal scan parameters. If you want the procedure to be completed faster, you may deselect all file systems except the one applied on your partition and disable IntelliRAW. After that, click "Start scan" and wait until the process is finished.

    Hint: More information about configuring the scan can be found in the instruction on scanning a drive with UFS Explorer.

  6. Browse through the found files and folders. They can be sorted by name, date, type or previewed in the internal viewer. The deleted ones can be identified by the red color of their names. Quick and advanced search options may also help if you need to find specific files.

    Hint: The information provided in Evaluation and saving the results of data recovery may facilitate your work with the obtained folders and files.

  7. Press the "Define selection" button, select the files and folders to be recovered and click "Save (recover) selection". Choose another partition/disk or a network location to copy the files.

    Hint: If you are going to save the recovered data to a network storage, please check the provided guide.

Note: If the data was lost from the "/root" directory and there is no possibility to extract the drive and attach it to another computer or some of the components needed to work with the software are missing in your operating system (an X-server, libraries, etc.), you can boot the machine using UFS Explorer Backup and Emergency Recovery CD for safe data recovery. For more details, please, refer to Data recovery from a system partition.

Last update: April 19, 2022

If you liked this article, you can share it on social media: