IT News & Technology update

Recovering a File in Linux

While you've lost what you had on screen, you may have forgotten that the computer still has it stored in RAM. You just need to find a way to get at it.

First things first, every step you take after the realization of the loss of your file can cause pieces of it to get overwritten (since this memory is now marked as free by the OS). So the first step is to create a snapshot of your current RAM. If you have alot of ram like me, this can take upwards of 1GB of space on your hard drive.

cp /dev/mem ~/memory.bin

When finished, you can open your memory file using the command "less":

less ~/memory.bin

When the program starts, it'll report that its trying to compute line numbers. Skip this by hitting ctrl+c once.

Now search for a unique word that you remember typing in your document by hitting forward slash (/) and the word. ie (/trickle). After much churning, matches will be displayed by less. Hit the up and down arrow keys to scroll from the hit point. To continue searching for the same phrase, simply hit / and enter again. Once you stumble upon your document, it may be in bad shape, but there should be enough information left to copy and paste out of the terminal.

No Comment | Posted in » Linux, Recovery, Suse, Tips