Skip to main content
Unix & Linux

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

20
  • 6
    Thank you for explaining the inner mechanics of the three different operations. This is really useful! Commented Aug 16, 2014 at 2:04
  • 1
    @Islam To get the preceding text block, I'd suggest giving a skip= value that's 1 block (512 bytes) less. In my example, $(expr 13813610612 / 512 - 1) . If that doesn't get what you want, try again while subtracting 16 or 32, which will look at the areas that are 8192 and 16384 bytes less; files are often allocated in 8192-byte chunks. If you're trying to recover a larger file, try larger counts to save time. I usually use count=16 and look at the result in an editor like emacs which doesn't mind if some of the data isn't text. Commented Apr 28, 2015 at 19:40
  • 1
    works great !! i used your solution with grep for a overwritten file !! Commented Aug 11, 2015 at 2:18
  • 1
    That grep trick is amazing. You sir, are a savior. Commented Nov 10, 2015 at 16:20
  • 4
    @EerikSvenPuudist That can happen because grep tries to read the input line by line, and on disk partitions with random bytes, the lines can be very long. A workaround is in the answer to this question. Instead of grep -i -a -B100 -A100 'text in the deleted file' /dev/sda1, try tr -s "\0" "\n" < /dev/sda1 | grep -i -a -B100 -A100 'text in the deleted file' Commented Aug 12, 2020 at 17:41