How to Recover Something Just Deleted on Linux

Accidentally deleting a file on Linux can feel like a sinking moment — especially if there's no Recycle Bin sitting between you and permanent loss. But depending on your filesystem, how quickly you act, and what tools you have available, recovery is often possible.

Here's what's actually happening when you delete a file, and what your realistic options are.

What Actually Happens When You Delete a File on Linux

When you delete a file using rm or empty a file manager's trash, Linux doesn't immediately wipe the data from storage. What it does is remove the directory entry (the filename and its pointer) and mark the disk blocks as available for reuse. The actual data often remains physically on the disk — at least until something else overwrites it.

This is why time matters enormously. The longer your system runs and writes data after a deletion, the higher the chance that those blocks get overwritten. On a busy system, that window can be minutes. On a quiet one, it might be days.

SSDs complicate this further. Many SSDs use a feature called TRIM, which proactively signals the operating system to wipe deleted blocks for performance reasons. On a TRIM-enabled SSD, recovery chances drop sharply and sometimes immediately after deletion.

Check the Trash First

If you deleted something through a graphical file manager like Nautilus, Thunar, or Dolphin — rather than via the terminal — it likely went to the Trash, not into the void.

You can find it at:

~/.local/share/Trash/files/ 

Files and their original metadata sit in the files/ and info/ subdirectories respectively. You can restore them manually by moving them back, or use the file manager's Trash interface.

If you used rm directly in the terminal, this safety net doesn't apply. rm bypasses the Trash entirely.

Terminal Deletion: Your Recovery Options 🔍

1. Check for Open File Handles

If a process still has the deleted file open, the data is still accessible — even after rm. This is one of the fastest recovery paths.

Run:

lsof | grep deleted 

If the file appears, you'll see a file descriptor number. You can copy the data back using:

cp /proc/<PID>/fd/<FD> /path/to/restored-file 

This only works if the process that had the file open is still running. Once it closes, this path closes too.

2. Use extundelete or ext4magic (ext4 Filesystems)

For ext3/ext4 filesystems, tools like extundelete and ext4magic can scan filesystem journals and inode tables to recover recently deleted files.

General workflow with extundelete:

sudo extundelete /dev/sdXN --restore-file path/to/deleted/file 

Replace /dev/sdXN with your actual partition. Unmount the partition before running recovery tools if possible — writing to the same partition you're recovering from increases the risk of overwriting the data you're trying to save.

ext4magic works similarly but tends to handle more complex recovery scenarios and gives you more control over the recovery window using filesystem journal timestamps.

3. Use PhotoRec or TestDisk (Filesystem-Agnostic)

TestDisk and its companion PhotoRec are open-source tools that work across multiple filesystem types — including ext4, NTFS, FAT, and others. They scan raw disk sectors for recognizable file signatures.

• TestDisk focuses on partition and filesystem structure recovery
• PhotoRec (despite the name) recovers a wide range of file types, not just photos

These are particularly useful when filesystem metadata is too damaged or overwritten for journal-based tools to help. The tradeoff: recovered files often lose their original filenames and directory structure.

Both are available in most Linux distribution repositories:

sudo apt install testdisk # Debian/Ubuntu sudo dnf install testdisk # Fedora 

4. Forensic Tools for Advanced Recovery

Tools like Scalpel and Foremost perform file carving — scanning raw disk data for known file header and footer signatures. They work on heavily overwritten or corrupted drives and are often used in digital forensics.

These require more technical confidence to use effectively and are best suited for situations where simpler tools have failed.

Key Variables That Affect Recovery Success

What to Do Immediately After Accidental Deletion

1. Stop using the affected partition as much as possible
2. Do not install recovery tools onto the same drive — use a USB drive or a separate partition
3. If the system is on an SSD, act within seconds if TRIM is active
4. Boot from a live USB environment for the safest recovery approach — this prevents your running OS from writing to the disk you're trying to recover

The Factor That Varies Most: Your Setup

Whether recovery is straightforward or essentially impossible depends heavily on details specific to your system — your storage type, filesystem, whether journaling is active, how recently the deletion happened, and what your system has been doing since. A freshly deleted file on a quiet HDD with ext4 is a very different situation from a file deleted 20 minutes ago on an NVMe SSD with TRIM active. The tools exist and the methods are well-established — but how well they'll work is something only your own setup can answer. 🖥️