Skip to content

Instantly share code, notes, and snippets.

@cmbaughman
Created July 1, 2014 03:16
Show Gist options
  • Save cmbaughman/afe6f9e11a2b19a427fe to your computer and use it in GitHub Desktop.
Save cmbaughman/afe6f9e11a2b19a427fe to your computer and use it in GitHub Desktop.
How to "UNDELETE" something deleted recently
#!/bin/bash
####
## NOTE: Change /dev/sda1 to the name of the device partition you
## deleted the file on.
# Also "x" needs to be big enough to hold the file contents.
###
grep --binary-files=text --context=x 'stringfromyourfile' \ /dev/sda1 > someFile.txt
###
# BONUS: To find something still in RAM, use something like
# this: if we are searching for a phone number that starts with
# 717
###
`strings < ramdump | grep "717" `
#### The best way for big files or other filetypes is to use the
#### command debug2fs http://www.linuxvoodoo.com/resources/howtos/debugfs
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment