Last week I was generating a MD5 sum for an virtual machine image on one OpenNebula server:
# ls -l test.img -rw-r--r-- 1 root root 10486808576 Oct 12 02:21 test.img # md5sum test.img
At the same time I was clearing the files on the server on another terminal and deleted the above image file mistakenly with :
# rm test.img
Since this image file is 10GB, it took some time to remove this file from the server, so I used the Ctrl+Z command to suspend the remove command.
[1]+ Stopped md5sum test.img
By doing this, we can recover the deleted image file later. The rationale here is if other programs are accessing the file, the OS will not delete the file indeed(even you execute the rm command). So if we suspend the md5sum command before the completion of rm command, then the test.img file will be held by md5sum and will not be removed by rm command.
We can execute jobs to see the md5sum process:
# jobs -l [1]+ 30888 Stopped md5sum test.img # ls -l /proc/30888/fd total 0 lrwx------ 1 root root 64 Oct 22 04:04 0 -> /dev/pts/3 lrwx------ 1 root root 64 Oct 22 04:04 1 -> /dev/pts/3 lrwx------ 1 root root 64 Oct 22 04:04 2 -> /dev/pts/3 lr-x------ 1 root root 64 Oct 22 04:04 3 -> /root/test.img (deleted)
Now we can use cp command to recover the file:
# cp /proc/30888/fd/3 save.img # ls -l save.img -rw-r--r-- 1 root root 10486808576 Oct 22 06:11 save.img
If you mistakenly delete text files, you can try to use grep command to recover deleted files; if you mistakenly delete exe/doc/png/jpg/gif files, you can use third party ext2/ext3 file recovery tools such as TestDisk, PhotoRec to recover deleted files.
Source : http://www.vpsee.com/2013/10/how-to-recover-a-large-deleted-file/
