Accidentally deleting an important file is stressful, but recovery is sometimes possible depending on the specific circumstances. This guide covers what to try and, importantly, sets realistic expectations.
Act Immediately — Stop Writing to the Disk
The moment you realize a file was deleted, stop any unnecessary disk activity — deleted file data isn't immediately erased, just marked as free space; new writes can overwrite that space, making recovery impossible. Every additional write reduces your recovery chances.
Check If It's Genuinely Deleted or Just Moved/Renamed
find / -name "filename*" 2>/dev/nullRule out the simpler explanation (it was moved, renamed, or you're looking in the wrong location) before assuming genuine deletion.
Check If a Process Still Has the File Open
lsof | grep deletedIf a running process still has the deleted file open (common if it was deleted while actively being written to), you may be able to recover it directly through /proc/PID/fd/ while that process remains running.
Recovering via an Open File Handle
cp /proc/PID/fd/FD_NUMBER /path/to/recovered-fileIf found via the previous step, copy the file content back out before the holding process closes or restarts.
Using Data Recovery Tools (For Genuinely Deleted Files)
sudo apt install extundelete testdisk -ytestdisk/photorec and extundelete are established tools for attempting file recovery from unmounted or read-only-remounted file systems.
Important: Recovery Attempts Should Use a Different Target Location
photorec /d /mnt/recovery /dev/sda1Never write recovered data back to the same disk/partition you're recovering from — this risks overwriting the very data you're trying to recover.
Realistic Expectations on a VPS
VPS storage is often backed by network/SAN storage with its own underlying redundancy and behavior, which can make traditional file-carving recovery techniques less reliable than on a simple local physical disk — success isn't guaranteed, and recovery tools work better for some file systems/scenarios than others.
Checking for a More Reliable Recovery Path: Backups
Before investing significant time in uncertain data recovery attempts, check whether the file exists in a recent backup (see How to Set Up Automated VPS Backups) — almost always faster and more reliable than file system-level recovery attempts.
Checking for Snapshots
See How to Use VPS Provider Snapshots Effectively — if you have a recent snapshot predating the deletion, restoring from it (or extracting just the needed file from a snapshot) may be more reliable than in-place recovery attempts.
The Real Lesson: Prevention
File recovery is uncertain at best — the actual solution to accidental deletion is having reliable, regularly-tested backups in place beforehand (see How to Set Up Automated VPS Backups), so you're restoring from a known-good backup rather than attempting uncertain forensic recovery after the fact.
Common Errors
Recovery tool finds the file but content is corrupted/incomplete — often means some of the file's disk space was already overwritten before recovery was attempted; underscores the importance of acting immediately and having backups as the reliable fallback.
Continue Reading
- How to Set Up Automated VPS Backups
- How to Use VPS Provider Snapshots Effectively
- How to Check and Manage Disk Usage on a Linux VPS
Browse more articles in Troubleshooting & FAQ.
