-1

Can we recover the data which has been truncated by >hello.log.

Rui F Ribeiro
  • 56,709
  • 26
  • 150
  • 232
Gaurav Bhaskar
  • 109
  • You don't provide much to go on. What have you tried? What filesystem type is it? How big was the file? Do you know any of the content in the file? – EightBitTony Mar 01 '16 at 12:22

2 Answers2

3

Firstly, depending on how long it has been, the answer may be no. If the filesystem is read/write then the content may be completely gone.

However, some people have some luck using this technique (which assumes the file is plain text, not binary data).

grep -a -A 1000 -F 'some known string' /dev/disk-device > recovered-file

So that would return 1000 lines of content, after 'some known string', searching the entire device (for example /dev/sda6). This technique is unreliable, especially for large files, and especially if the file is fragmented (rare, but not impossible).

There are hundreds of caveats. You should immediately remount the existing impacted filesystem as read only for example, and so you need to be careful where you're writing the recovered-file. If the impacted file is on a filesystem you can't easily remount read-only you may want to boot from recovery media.

There are other options, this answer over at AskUbuntu has more (and is where I took the above example).

Answers on this site include,

Community
  • 1
EightBitTony
  • 21,373
1

Using testdisk to recover files is godsend in many of situations I was facing. For this to work smoothly, you need to be able to umount the hard drive before you could find the node you wanted to recover. This package uses extundelete as dependency to accomplish the job, which was the gold star in making my recovery....every time.

Faron
  • 113