Recover Accidentally Deleted Linux Files with lsof and extundelete

Linux does not provide a visible recycle bin like Windows, so file restoration depends on whether the deleting process is still running.

Case 1: The deleting process is still alive

If a process still has the file open, the file’s inode remains accessible. Use lsof | grep deleted to locate such processes, then copy the file from the process’s file‑descriptor directory.

echo "hello py" > testdelete.py
cat >> testdelete.py
# output: hello delete
rm -f ./testdelete.py
# Verify the file is gone
lsof | grep deleted
# Example output shows a process still holding the file
cp /proc/20464/fd/1 /tmp/recovered_testdelete.py

After copying, the recovered file can be inspected with cat /tmp/recovered_testdelete.py.

Case 2: The process has terminated – use extundelete

When no process holds the deleted file, a third‑party recovery tool such as extundelete is required. Follow these steps:

Stop all activity on the affected partition to avoid inode overwriting (unmount the filesystem or stop services).

(Optional) Create a raw backup with dd if=/dev/vdb1 of=/path/backup.img to protect data.

Install extundelete:

wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2
tar jxvf extundelete-0.2.4.tar.bz2
cd extundelete-0.2.4
./configure
make
make install

Run extundelete to restore files:

# Restore a single file by name
extundelete /dev/vdb1 --restore-file passwd
# Restore an entire directory
extundelete /dev/vdb1 --restore-directory deletetest
# Restore all recoverable files
extundelete /dev/vdb1 --restore-all

Recovered files are placed in the RECOVERED_FILES directory; verify their contents with cat or other tools.

Note that restored inodes may receive new filenames, so rename them as needed. The content of the files remains intact.