How to Recover Something Just Deleted on Linux

Accidentally deleting a file on Linux can feel like a sinking moment — especially if there's no Recycle Bin sitting between you and permanent loss. But depending on your filesystem, how quickly you act, and what tools you have available, recovery is often possible.

Here's what's actually happening when you delete a file, and what your realistic options are.

What Actually Happens When You Delete a File on Linux

When you delete a file using rm or empty a file manager's trash, Linux doesn't immediately wipe the data from storage. What it does is remove the directory entry (the filename and its pointer) and mark the disk blocks as available for reuse. The actual data often remains physically on the disk — at least until something else overwrites it.

This is why time matters enormously. The longer your system runs and writes data after a deletion, the higher the chance that those blocks get overwritten. On a busy system, that window can be minutes. On a quiet one, it might be days.

SSDs complicate this further. Many SSDs use a feature called TRIM, which proactively signals the operating system to wipe deleted blocks for performance reasons. On a TRIM-enabled SSD, recovery chances drop sharply and sometimes immediately after deletion.

Check the Trash First

If you deleted something through a graphical file manager like Nautilus, Thunar, or Dolphin — rather than via the terminal — it likely went to the Trash, not into the void.

You can find it at:

Files and their original metadata sit in the files/ and info/ subdirectories respectively. You can restore them manually by moving them back, or use the file manager's Trash interface.

If you used rm directly in the terminal, this safety net doesn't apply. rm bypasses the Trash entirely.

Terminal Deletion: Your Recovery Options 🔍

1. Check for Open File Handles

If a process still has the deleted file open, the data is still accessible — even after rm. This is one of the fastest recovery paths.

Run: