Recovering a File in Linux

By: mlfarrell

March 2, 2007 10:25 am






You’re working on an important document and the following happens:

  • The application crashes!
  • You close out without saving
  • You save over a document you just had open!


While you’ve lost what you had on screen, you may have forgotten that the computer still has it stored in RAM. You just need to find a way to get at it.

First things first, every step you take after the realization of the loss of your file can cause pieces of it to get overwritten (since this memory is now marked as free by the OS). So the first step is to create a snapshot of your current RAM. If you have alot of ram like me, this can take upwards of 1GB of space on your hard drive.

cp /dev/mem ~/memory.bin

When finished, you can open your memory file using the command “less”:

less ~/memory.bin

When the program starts, it’ll report that its trying to compute line numbers. Skip this by hitting ctrl+c once.

Now search for a unique word that you remember typing in your document by hitting forward slash (/) and the word. ie (/trickle). After much churning, matches will be displayed by less. Hit the up and down arrow keys to scroll from the hit point. To continue searching for the same phrase, simply hit / and enter again. Once you stumble upon your document, it may be in bad shape, but there should be enough information left to copy and paste out of the terminal.

0 votes, average: 0.00 out of 50 votes, average: 0.00 out of 50 votes, average: 0.00 out of 50 votes, average: 0.00 out of 50 votes, average: 0.00 out of 5 (0 votes, average: 0.00 out of 5)
You need to be a registered member to rate this post.

Categories: Uncategorized

Disclaimer: As with everything else in the SUSE Blog, this content is definitely not supported by SUSE (so don't even think of calling Support if you try something and it blows up).  It was contributed by a community member and is published "as is." It seems to have worked for at least one person, and might work for you. But please be sure to test, test, test before you do anything drastic with it.