# Can files/directories deleted with rm be restored?

Is it possible to restore files/directories which are deleted from terminal using rm and rm -r?. If a file is deleted from graphical interface, it could be restored from trash, but how do you restore a file if it is removed using the rm utility?.

To this end I use trash-cli package and the following alias in my ~/.bashrc

alias rm=trash


And the trash-cli package can be installed by the followoing command: sudo apt-get install trash-cli.

The files you remove will be moved to trash, and you can see them in nautilus trashcan.

You can always access the real rm by using one of the following method:

command rm something
'rm' something
\rm something


There are also commands to access the trashcan from terminal, trash-list, restore-trash (or trash-restore), trash-empty installable from package trash-cli (then see their man pages).

Last note, it is not advisable to use such an alias for super-user, because it can interfere with system operations.

• It is a work-around, but does not really answer the question. – evgeny Oct 13 '10 at 7:09
• I think the user also would to know if there is some method to achieve the same behavior from command line. If not, I am ready to remove my answer. – enzotib Oct 13 '10 at 7:18
• It's good. I have gained some knowledge. – user3215 Oct 13 '10 at 8:05

Deleting it from terminal deletes it permanently - recovery is very hard and sometimes impossible.

If your partition type is ext3 (check it by using the System->Administration->Disk Utility), then take a look at ext3undel.

If it is not (if you installed Ubuntu with default settings), try the extundelete program.

There is no guarantee you will recover anything though.

• It would be really useful for desktop editions. – user3215 Oct 13 '10 at 8:07
• I doubt this works effectively for SSD drives, but happy to hear otherwise – matt Nov 21 '18 at 10:45

You are looking for: extundelete - utility to recover deleted files from ext3/ext4 partition

To find such a package, you can try: apt-cache search undelete

To use the utility install it with: sudo apt-get install extundelete

After installation invoke man extundelete and study it carefully.

Just as an alternative, if you know specifically what type of file it is...

sudo apt-get install foremost


Now open up /etc/foremost.conf and you will see a long list of commented out lines. If your file type exists, uncomment the line (you may also want to remove the irrelevant lines).

If your file type does not exist, add your own line. Say I want to recover a .css file and I know its around 40K. I could do add this:

css     n       40000   Theme\sName:     Plugin\sFixes


The 2nd column refers to case-sensitivity, the third column refers to the upper limit for size, the 4th column is how the file starts (remember to use escaped characters) and the last column is how the file usually ends.

Use the following command (edit the disk accordingly. could check with df command)

foremost -v -T -c /etc/foremost.conf -i /dev/sda -o output


What will happen next is that foremost will create a folder called output and dump all the recovered data (in this case) into the folder. From there you could use diff or meld to compare the recovered 'files' and see which is the most up to date.

• thanks a lot. It worked perfectly. I accidentally removed my php source file using rm -fr php/ with 2 php files. Less than 2 minutes they were recovered perfectly. In the .conf file I added: php n 40000 <?php ?> ASCII – Shakiba Moshiri Apr 3 '18 at 16:37

Speaking in the most abstract terms, whenever you delete a file on the graphical interface, the file is "moved" to a special "buffer", a directory called trash. You can locate it in your home directory, ~/.local/share/Trash/. Files "deleted" from this directory, will be really deleted. This real deletion is what happens when you use rm on a file.

It's extremely hard to recover deleted files. Files in the file system are represented as nodes on a B-tree or the like. When a file is deleted using rm, the tree is updated, number of hardlinks are reduced, the corresponding entry in the directory listing is removed. If at all, your file had a hard link, your file is absolutely safe. You can do a file / -samefile filename. You can search the file if you remember its inode number too (this is hardly the case).

Another case is when none of the above possibilities is true. Whenever you rm a file, the file entry on the directory is removed, reducing the number of hardlinks by one. And if the number of hard links drops to zero, then the pointer to the file on the inode is dropped, or is marked to be deleted. Either way, your file "still" resides on the hard disk. The file is actually erased from hard disk only on subsequent remount. File recovery at such a time is extremely hard, involves going through the file system tree and the inodes representing actual disk block locations. There's a popular tool I've heard of, but never used it, called extundelete. Although there's no guarantee, its worth giving a try.

Once you recover your files successfully or not, make haste to do regular backups. It's extremely simple on Ubuntu.

Sorry, but files deleted from a command-line with the "rm" and "rm -f" bypass the "Trashcan" you have on the Gnome desktop.

You may also want to ask if there are any extfs "undelete" tools like there are for FAT and NTFS. (I don't know of any, but I'd be surprised if there were none.)

• Oh... it's ok!. I thought it could be recovered from some location. – user3215 Oct 13 '10 at 6:49

use "rm-trash" utility which handles puts them to trash for later retrieval and supports all options of "rm" command.

sudo add-apt-repository ppa:nateshmbhat/rm-trash
sudo apt-get update
sudo apt-get install rm-trash


"rm-trash" is

• meant to be used in place of rm
• handles all options that rm can take
• handles the file name collisions with the files already in trash
• handles some permission issues automatically
• if rm is called from any other script or indirectly then the system 'rm' command is used automatically
• shows the appropriate error messages like those which arise in rm