How to List Recently Deleted Files from a Directory

How to list recently deleted files from a directory?

You can use the debugfs utility,

debugfs is a simple to use RAM-based file system specially designed
for debugging purposes

First, run debugfs /dev/hda13 in your terminal (replacing /dev/hda13 with your own disk/partition).

(NOTE: You can find the name of your disk by running df / in the terminal).

Once in debug mode, you can use the command lsdel to list inodes corresponding with deleted files.

When files are removed in linux they are only un-linked but their
inodes (addresses in the disk where the file is actually present) are
not removed

To get paths of these deleted files you can use debugfs -R "ncheck 320236" replacing the number with your particular inode.

Inode   Pathname
320236  /path/to/file

From here you can also inspect the contents of deleted files with cat. (NOTE: You can also recover from here if necessary).

Great post about this here.

How can I list all the deleted files in a Git repository?

git log --diff-filter=D --summary

See Find and restore a deleted file in a Git repository

If you don't want all the information about which commit they were removed in, you can just add a grep delete in there.

git log --diff-filter=D --summary | grep delete

PowerShell get deleted files of a folder

The NameSpace method returns a Folder object which provides a GetDetailsOf method you can use to retrieve details about each member of Items:

New-Variable -Name 'ssfBITBUCKET'                       -Option Constant -Value 0x0A;
New-Variable -Name 'BitBucketDetails_Name'              -Option Constant -Value 0;
New-Variable -Name 'BitBucketDetails_ParentPath'        -Option Constant -Value 1;
New-Variable -Name 'BitBucketDetails_DeletionTimeText'  -Option Constant -Value 2;
New-Variable -Name 'BitBucketDetails_SizeText'          -Option Constant -Value 3;
New-Variable -Name 'BitBucketDetails_Type'              -Option Constant -Value 4;
New-Variable -Name 'BitBucketDetails_LastWriteTimeText' -Option Constant -Value 5;
New-Variable -Name 'BitBucketDetails_CreationTimeText'  -Option Constant -Value 6;
New-Variable -Name 'BitBucketDetails_LastAccessTimeText'-Option Constant -Value 7;
New-Variable -Name 'BitBucketDetails_AttributesText'    -Option Constant -Value 8;

$application = New-Object -ComObject 'Shell.Application';
$bitBucket = $application.NameSpace($ssfBITBUCKET);

foreach ($deletedItem in $bitBucket.Items())
{
    New-Object -TypeName 'PSObject' -Property @{
        # Same as $deletedItem.Name
        Name =               $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_Name);
        ParentPath =         $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_ParentPath);
        DeletionTimeText =   $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_DeletionTimeText);
        Size =               $deletedItem.Size;
        SizeText =           $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_SizeText);
        # Same as $deletedItem.Type
        Type =               $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_Type);
        LastWriteTime =      $deletedItem.ModifyDate;
        LastWriteTimeText =  $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_LastWriteTimeText);
        CreationTimeText =   $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_CreationTimeText);
        LastAccessTimeText = $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_LastAccessTimeText);
        AttributesText =     $bitBucket.GetDetailsOf($deletedItem, $BitBucketDetails_AttributesText);
        IsFolder =           $deletedItem.IsFolder();
        BitBucketPath =      $deletedItem.Path;
    };
}

ssfBITBUCKET is from the ShellSpecialFolderConstants enumeration. On my Windows 10 system set to the en-US culture, when a BitBucketDetails_*TimeText constant is passed to GetDetailsOf() it returns not a DateTime instance but a timestamp in the form of a String where the year, month, and day are each preceded by a left-to-right mark ([Char] 0x200E) and the time is preceded by a right-to-left mark ([Char] 0x200F) followed by a left-to-right mark.

I determined the BitBucketDetails_* constants myself since I didn't find them documented anywhere, but according to this answer you can query for them by passing $null as the first parameter to GetDetailsOf(). Thus, you can keep querying the column names from the bit bucket namespace until it starts returning empty Strings like this...

New-Variable -Name 'ssfBITBUCKET' -Option Constant -Value 0x0A;

$application = New-Object -ComObject 'Shell.Application';
$bitBucket = $application.NameSpace($ssfBITBUCKET);

for ($column = 0; -not [String]::IsNullOrEmpty(($details = $bitbucket.GetDetailsOf($null, $column))); $column++)
{
    New-Object -TypeName 'PSObject' -Property @{
        Column = $column;
        Name = $details;
    };
}

...which outputs this on my system...

Column Name
------ ----
     0 Name
     1 Original Location
     2 Date Deleted
     3 Size
     4 Item type
     5 Date modified
     6 Date created
     7 Date accessed
     8 Attributes
     ...

Recover deleted folder from Google VPS

Getting any files back from your VM's disk may be tricky (at best) or impossible (most probably) if the files got overwritten.

Easiest way would be to get them back from a copy or snapshot of your VM's disk. If you have a snapshot of your disk (either taken manually or automatically) from before when the folder in question got delete then you will get your files back.

If you don't have any backups then you may try to recover the files - I've found many guides and tutorials, let me just link the ones I believe would help you the most:

• Unix/Linux undelete/recover deleted files
• Recovering accidentally deleted files
• Get list of files deleted by rm -rf

------------- UPDATE -----------

Your last chance in this battle is to make two clones of the disk
and then detach original disk from the VM and attach one of the clones to keep your VM running. Then use second clone for any experiments. Keep the original untouched in case you mess up the second clone.

Now create a new Windows VM and attach your second clone as the additional disk. At this moment you're ready to try various data redovery software;

• UFS Explorer
• Virtual Machine Data Recovery

There are plenty of others to try from too.

Another approach would be to create an image from the original disk and export it as a VMDK imagae (and save it to a storage bucket). Then download it to yor local computer and then use for example VMware VMDK Recovery or other specialized software for extracting data from virtual machines disk images.

How to retrieve ALL files deleted from a folder (where the folder does not appear in checkouts anymore)

You need to give the -d option but not the -P option to cvs update so that it gets all directories on the server but doesn't prune empty ones. Then you should be able to use the add commands to resurrect the files.

examining history of deleted file

To get the log of a deleted file, use

svn log -r lastrevisionthefileexisted

If you want to resurrect the file and keep its version history, use

svn copy url/of/file@lastrevisionthefileexisted -r lastrevisionthefileexisted path/to/workingcopy/file

If you just want the file content but unversioned (e.g., for a quick inspection), use

svn cat url/of/file@lastrevisionthefileexisted -r latrevisionthefileexisted > file

In any case, DO NOT use 'svn up' to get a deleted file back!

---

Related Topics