Recover Deleted Files After rm on Ubuntu

Updated 10 November 2026 · Standard formula, shown below

Files removed with the rm command on Ubuntu usually bypass the desktop Trash, and there is no reliable undo command. Recovery may still be possible if the deleted data has not been overwritten, but the safest first move is to stop writing to the affected storage and recover from a backup or a separate recovery environment.

What rm does to a file

On a typical Linux filesystem, a filename points to file data recorded in filesystem metadata. The rm command removes the directory entry and marks the file’s storage as available for reuse; it does not normally move the file to Trash or immediately erase every data block. This distinction explains why recovery can sometimes work, but it is not a guarantee: as the system writes new data, it can reuse the released space.

There is no universal “undelete” command for Ubuntu. Outcomes depend on the filesystem, storage device, how much activity occurred after deletion, and whether the data was encrypted, compressed, or stored on a copy-on-write filesystem. Solid-state drives may also issue TRIM or discard operations that tell the device which blocks are no longer needed; after that, recovery can be especially difficult or impossible.

First response: stop using the affected storage

Do not install recovery software, download files, run system updates, or save recovered output onto the same partition. Those actions can overwrite the very data being sought. If the deleted files are important, shut down the computer rather than continuing to experiment. For a mounted external drive, stop using it and disconnect it safely if possible.

Identify which device and partition held the files. Commands such as lsblk -f can help list storage devices and filesystem types, but avoid writing changes to the affected disk.
Do not run filesystem repair tools on the original device before making an image; repairs can change metadata.
Recover to a different physical disk, not merely another directory on the same drive.
If the data is irreplaceable or the disk is failing, stop and consider a professional data-recovery service. Repeated DIY attempts can reduce the chance of success.

Check easier recovery options first

Before attempting undelete tools, look for another copy. A file may exist in a backup, a synced folder’s web-based recycle area, an email attachment, a source-control repository, or an application’s own autosave or version history. Check the desktop Trash too if the file may have been deleted through a graphical file manager rather than by rm.

Also confirm the file was actually deleted. Search likely directories, check spelling and hidden files, and inspect the command history if needed. For example, rm report.txt removes a file in the current directory, while rm -r project can remove a directory and its contents. Shell history may show the command, but it does not restore data. Be cautious about sharing command history because it can contain private information.

Recovery methods and when they may help

There is no single best tool for every Ubuntu filesystem. Recovery utilities may scan filesystem metadata for deleted entries or search the disk for recognizable file contents. Metadata-based recovery can retain filenames and folder structure when records remain; carving based on file signatures may find content but often loses names and directory organization. Fragmented files may be incomplete.

Restore a backup or snapshot: Usually the most reliable option. Check the backup date and restore to a separate location so you do not overwrite newer files.
Use a live USB environment: Booting from a separate system can avoid routine writes to the installed Ubuntu system. Do not mount the affected partition read-write.
Image the drive, then scan the image: A sector-by-sector image preserves the original state for repeated attempts. This requires another disk with enough free space and careful handling; a failing drive may need specialist equipment.
Try a recovery utility suited to the filesystem: Tools differ in what filesystems and recovery methods they support. Read their documentation, and save found files to another drive. Do not assume a scan result means every recovered file is intact.

Filesystem-specific tools may be useful in some cases, but support and procedures vary. For ext-family filesystems, recovery attempts can depend on filesystem state and whether the partition has been mounted or modified since deletion. For Btrfs or ZFS, snapshots may offer a better route if they were created before the deletion. Encryption adds another constraint: recovery requires access to the correct decrypted data or keys, and recovering raw encrypted blocks is not equivalent to restoring usable files.

Why recovery often fails

Recovery is least promising after continued use of the same partition, because ordinary activity—logs, browser caches, updates, temporary files, and application data—can reuse freed blocks. On SSDs, TRIM can make blocks unavailable to ordinary recovery software even when the operating system has not yet visibly overwritten them. Secure deletion tools, full-disk encryption changes, or reformatting can further reduce the prospects.

Another common misconception is that sudo or a different spelling of rm can reverse deletion. They cannot. Likewise, the Trash is not a universal safety net: the command-line rm normally unlinks files directly. Some shell setups provide a separate “trash” command or alias, but that only helps if it was configured and used before deletion.

Prevent the next accidental deletion

Use a backup strategy that keeps at least one copy separate from the computer, and test that files can actually be restored. Snapshots can provide quick rollback for supported filesystems, but they are not a substitute for an independent backup if the disk fails or the whole machine is lost.

Review a command’s target with pwd and ls before running destructive commands.
Use interactive options such as rm -i when deleting selected files manually, while remembering that they do not protect every script or command.
Avoid casually copying commands that include -r, wildcards, or elevated privileges; verify the path and expansion first.
For important work, keep versioned backups or use an application and storage workflow with snapshots or revision history.

Frequently Asked Questions

Can I undo rm in Ubuntu?
No. The standard rm command has no undo feature. Recovery may be possible from backups or, in some circumstances, with filesystem recovery tools if the data has not been overwritten or discarded.

Does rm move files to Trash?
Usually not. Command-line rm removes directory entries directly. Deleting through a graphical file manager commonly uses Trash, but behavior depends on the application and location.

Should I keep using my computer while looking for recovery software?
No, not if the deleted files matter. Continued writes can overwrite recoverable data. Avoid installing tools on the affected partition, and save any recovered files to a different physical drive.

Can deleted files be recovered from an SSD?
Sometimes, but the odds can be lower than on some other storage because TRIM or discard may make deleted blocks unavailable. The result depends on the device, filesystem, timing, and subsequent use.

Can I recover a file after emptying Trash?
Possibly, but emptying Trash removes the easy restore route. Stop using the storage and check backups or snapshots; otherwise, recovery depends on whether the data remains available and has not been overwritten.

Is there a command that shows what rm deleted?
Not by default. Shell history may show the command that was entered, but it generally does not maintain a recoverable list of deleted files. Logs or backups may provide clues, depending on the system’s configuration.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.