Is there any way to restore deleted files from Unix, BSD and Solaris?
Most users of UNIX and UNIX-based operating systems, like BSD and Solaris, find it more convenient to delete files and directories using the rm command from the command line. When followed by the -I, –r, or -f option, this command allows speeding up the process of removing items, especially when numerous similar files are involved. However, this method poses a higher risk of mishaps. The thing is that when you delete files in such a way, the OS doesn’t ask for confirmation before removing each file but just immediately gets rid of them. Other options are usually more secure but, unfortunately, none of them can entirely protect the user from accidental deletion of important information.
Once the mistake becomes evident, an urgent need may arise to recover deleted files. Thankfully, their data blocks and some of their attributes remain on the storage until overwritten by other information. They simply get marked as deleted and become inaccessible using standard means. The chances for recovery of deleted data depend mainly on the amount of subsequent write activity and the methods chosen to restore deleted files.
How to recover deleted files from UNIX, OpenBSD, NetBSD, FreeBSD, Solaris
The major file systems employed in the UNIX environment are UFS (UFS2) and ZFS, although more and more systems make use of ones borrowed from the Linux family. Each of them has its own algorithms of file deletion described in Peculiarities of data recovery depending on the OS. These specificities determine the techniques used by data recovery software to restore deleted files and influence the quality of the obtained results. Still, from the perspective of the user, the steps performed to retrieve deleted data won’t significantly differ from data recovery under Linux.
On the other hand, please mind that recovery of files deleted or lost from the above-mentioned files systems is only possible before they get replaced (i.e. overwritten) with some other information. For this reason, it is highly recommended to stop all operations with the storage device the data is missing from and promptly start recovering it.
Additionally, it should be mentioned that the contents of the files deleted from a solid state drive (SSD) with the enabled TRIM command are very likely to be wiped from it right after deletion. Under such circumstances, their recovery is usually beyond the bounds of possibility.
For the rest of data loss cases, SysDev Laboratories recommends UFS Explorer Standard Recovery and other UFS Explorer products as effective software solutions that work with UFS (UFS2) and all of the most popular Linux file systems as well as both simple and stripe ZFS volumes.
-
In order to prevent overwriting of deleted files by some user or process, switch the system to a single-user mode and unmount the file system of the problem directory by running the "unmount" command with the name of the disk or the mount point.
As the "/root" directory cannot be unmounted, if the deleted data was stored there, it is strongly recommended to remove the drive from the computer and connect it to another machine as a secondary storage.
Hint: Please rely on the instructions if you need to attach your hard disk drive to the motherboard or сonnect the HDD externally using a USB to SATA adapter.
-
Download the installation file of UFS Explorer Standard Recovery by choosing the "Download for Linux" option, extract the content of the downloaded archive and launch the installer after entering your user password. Please refrain from using for this purpose the partition you want to restore files from, as any new data saved to it may lead to the overwriting of the current information, including the deleted files. And once overwritten, these files are lost beyond recovery.
Note: To run UFS Explorer Standard Recovery, your operating system needs to have an X-Server (X11) and the necessary shared libraries. In case of installation failure, execute the ldd command to check which libraries are missing and install them.
-
Run the application and, if necessary, modify the program settings which can be found in the settings pane.
-
UFS Explorer Standard Recovery automatically recognizes available partitions and displays them in the storages list located in the left pane. Find and select the needed partition based on its size, file system type or content. Then launch its scanning for lost data using the "Scan this storage" tool from the toolbar, the "Start scan" button or the corresponding option in the storage context menu.
-
Define the optimal scan parameters. If you want the procedure to be completed faster, you may deselect all file systems except the one applied on your partition and disable IntelliRAW. After that, click "Start scan" and wait until the process is finished.
Hint: More information about configuring the scan can be found in the instruction on scanning a drive with UFS Explorer.
-
Browse through the found files and folders. They can be sorted by name, date, type or previewed in the internal viewer. The deleted ones can be identified by the red color of their names. Quick and advanced search options may also help if you need to find specific files.
Hint: The instructions of the article Evaluation and saving the results of data recovery may be very helpful when working with the obtained folders and files.
-
Press the "Define selection" button, select the files and folders to be copied and click "Save (recover) selection". Choose another partition/disk or a network location as a destination storage. Please ensure that you are not saving recovered data to that very storage they are being retrieved from, as these may ruin the results of recovery and cause permanent data loss.
Hint: If you are going to save the recovered data to a network storage, please check the provided guide.
Note: If the data was lost from the "/root" directory and there is no possibility to extract the drive and attach it to another computer or some of the components needed to work with the software are missing in your operating system (an X-server, libraries, etc.), you can boot the machine using UFS Explorer Backup and Emergency Recovery CD for safe data recovery. For more details, please, refer to Data recovery from a system partition.
Last update: June 17, 2024