Linux · August 16, 2016 2

How to recover overwritten files in linux

Mostly I work on live ftps using gedit or notepad++ and filezilla.

Last day I was working on a file and suddenly filezilla overwritten that file with 0 bytes on ftp. That was a horrible and destroying as that files was backbone of my project.

After using different file recovery tools I was disappointed then I gave it a last try reading hard drive sectors for a specific string and that was just awesome it recovered all my code and saved my life.

To recover files, you need ssh access to server.

Use SSH to get login into server, once logged in switch to root and perform following steps.

 
$ su
# umount /home
# grep -a -A800 -B800 'get_post_mtea' /dev/sda2 | strings > recovered_file

The code above reads hard drive sectors and match with “get_post_mtea” and stores all related results into recovered_file.

After it is done, just open the file and look for your code.
Note: File should be pretty large so you will need to split file into more files and search through files.