Recover deleted commands from history?

Question

If someone were to delete commands from the shells history, is there any way to recover those deleted commands in Linux?

Solution

With $disk being the disk or partition that contained the history file, and $cmd being a very distinct part of a command that you remember being in said history, and 100 being the number of commands that were in your history in total, then maybe

strings -w "$disk" | grep -C 100 "$cmd"

would find some fragments of it. The condition would be that the history file was deleted or truncated, but not overwritten in place or TRIM/discarded.

strings extracts all human-readable strings from a raw device. grep searches them and with the -C option also provides lines of context.

If you're looking for histories from other people, so you don't know any command after all... then maybe you could grep for ^cd \.\.$. It's a command that appears in most histories (at least, if the user is navigating directories at all). At the same time it's only rarely used in scripts.

Comments

[Minix]

Hello vijay. What type of shell are you using?