How to recover files truncated by `>`?

Question

I had a text file hello.txt which contains about 100 lines.I accidentally deleted all the lines by running echo > hello.txt

Now i want to recover all the 100 lines.Is there any way to recover the lines in that file using terminal commands?

Answer 1

You can not get back the contents. There is no mercy.

But search for backup files. If you are lucky enough there will be a file named hello.txt~ for hello.txt in the same directory. Those files are usually created by text editors like gedit or emacs when you edit a file.

If you have such backup file you can get the contents back (you may get back only a part also). Use the following in the terminal,

mv hello.txt~ hello.txt

It is better to have even a part than losing it completely.

Answer 2

tl;dr Skip to the end for the working solution.

I accidentally truncated a file using gedit. It was truncated from 1800 kB down to 25 kB.

I wanted to share a few recovery techniques I attempted. This isn't meant to be a definitive answer, more a collection of answers to try. This is similar to this post.

---

First, remount the filesystem as readonly!. Do this as soon as possible.

sudo mount -o remount,ro /

In my case, I was unable to remount readonly, so...

The mount command failed. with error mount: / is busy.

I recommend the drastic step of just hard powering off your machine. Yes, drastic! But I don't know how long the remnants of the truncated file will be around. They may be overwritten at any moment. Boot up into the Ubuntu LiveCD.

Per a comment here, I ran telinit 1 which dropped down to init level 1. This only complicated things so I don't recommend doing telinit 1. I recommend the hard power down.

attempt using ext3grep

Following this blog post and this email thread, try using ext3grep.
However, ext3grep failed for me. I was only able to recover the truncated file.

attempt using sleuthkit

sleuthkit is cool toolset. You'll probably have to install it. Again, this get's tricky if the truncated file was the / mount. Again, I recommend hard powering off and then running a LiveCD. Using this blog post, and this blog post, the instructions are essentially

1. apt-get install sleuthkit
   
2. stat truncated-file | grep Inode
   remember the inode number (call it INODE_NUMBER)
   
3. backup the file, then delete it:
   cp -a truncated-file truncated-file.old
rm truncated-file
   
   1. debugfs /dev/disk-device
      
   2. stats
      look for Blocks per group
      This is very likely 32768. (call it BLOCKS_PER_GROUP)
      
   3. imap to get the block
      imap <$INODE_NUMBER>
      remember the block number (call it BLOCK_NUMBER)
      
4. use blkls to copy the blocks to a file
   blkls /dev/disk-device $BLOCK_NUMBER-$(echo '$BLOCK_NUMBER+$BLOCKS_PER_GROUP-1' | bc) > recovered-file
   
5. manually review and clean up recovered-file using some editor program
   

But sleuthkit did not work for me. Only the truncated file was recovered.

attempt using extundelete

From this forum post.

attempt using grep

From this post, grep for some known string in the truncated file. This is the only method that worked for me.

grep -a -A 1000 -F 'some known string' \
    /dev/disk-device > recovered-file

Surprisingly simple, eh?

Answer 3

Sorry friend, It's impossible...

You can recover deleted files but you can't recover a file with deleted content..