-1

Is there a way to revert to a previous version of a file that has been changed by a program different from a text editor?

In my case I was using KeePassX and after adding a new password and saving the database, its size was '0 bytes' and couldn't be opened anymore. So all my passwords are now inaccessible.

Is there a way to access the previous, non-destroyed version of the database? Unfortunately, I never made any backups of it.

I am using Ubuntu 14.04 with KeePassX 0.4.3.

I am aware of this question Can overwritten files be recovered? but its focus is on command line actions such as copy or move.

Community
  • 1
Robert Schmidt
  • 1
  • 1
    What exactly does "changed and actually destroyed" mean? If the file was merely unlinked, then it might be recovered from the filesystem with appropriate tools and technique and time, as the data is (probably) still there. – thrig Sep 17 '16 at 16:16
  • @thrig updated question to clarify: The program has generated a new version of the file but with the same name. – Robert Schmidt Sep 17 '16 at 16:32
  • The details of which program deleted or overwrote the file are irrelevant. No need to ask yet another question on this topic. – Gilles 'SO- stop being evil' Sep 18 '16 at 22:01

2 Answers2

0

Apart from data recovery, which you already mentioned:
If you do not have a backup of your file, then: No.

I know this doesn't help you now, but maybe it may be an example for others:
Please backup!

Jan
  • 7,772
  • 2
  • 35
  • 41
0

The data may actually still exist if the disk space has not been reused by the filesystem (driver). If it is important and you can recognise data inside the file (e.g. a text file with known strings) I would boot some other Linux (e.g. from CD or USB thumb drive) and scan the relevant disk partition manually (or use a tool), e.g. by typing (as root):

hexdump -C /dev/sdb2 | less

where /dev/sdb2 needs to be replaced by your data partition (use lsblk to find out which one it is). Then, in the less output, search for a few characters of text (using /text) and hope it is not broken across a line (if it is, look for some other text).

This seems tedious? I did say "if it is important".

There are, of course, tools which do that for you.

Ned64
  • 8,726
  • I am currently trying what you suggested, searching the for text in less. Can you suggest any tools which are easier to use then piping the output of hexdump to less? Why would you want to boot another Linux? For me sudo hexdump ... worked just fine. – Robert Schmidt Sep 18 '16 at 08:49
  • A booted Linux system will write on the / partition, therefore I would not boot a system from which data needs to be recovered. When files are deleted the corresponding disk areas are marked as available for re-use. Once re-used for other data the original data in those disk areas are gone beyond what "normal people" can recover. As for the method I suggested--sorry but I do not know tools that can do more, though they exist. Please consult your favourite search engine for pointers. Anyway, if my method "worked just fine" I would be happy if you could mark the answer accordingly, thanks. – Ned64 Sep 29 '16 at 10:43