Created
July 1, 2014 03:16
-
-
Save cmbaughman/afe6f9e11a2b19a427fe to your computer and use it in GitHub Desktop.
How to "UNDELETE" something deleted recently
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/bash | |
#### | |
## NOTE: Change /dev/sda1 to the name of the device partition you | |
## deleted the file on. | |
# Also "x" needs to be big enough to hold the file contents. | |
### | |
grep --binary-files=text --context=x 'stringfromyourfile' \ /dev/sda1 > someFile.txt | |
### | |
# BONUS: To find something still in RAM, use something like | |
# this: if we are searching for a phone number that starts with | |
# 717 | |
### | |
`strings < ramdump | grep "717" ` | |
#### The best way for big files or other filetypes is to use the | |
#### command debug2fs http://www.linuxvoodoo.com/resources/howtos/debugfs |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment