<p>There's no special feature to undelete files on the host provided by docker. So if you delete your files using docker, you are left with the same option as when you delete on Linux without using docker:</p>
<ol>
<li>Learn from your mistake and don't do it again (I'd recommend forwarding logs to an external log aggregator).</li>
<li>Restore from backup.</li>
<li>Do a forensic recovery of the hard drive contents.</li>
</ol>

CC BY-SA 4.0
2020-12-29T19:24:30.957Z
2020-12-29T19:24:30.957Z
BMitch
<p>I had to, so I removed a service with docker service rm but I forgot to get the log files of the service. Now I am not able to find those. Can anyone help me or suggest to me if and how can I get those log files. I was using json-files driver for logging via yml.</p>

CC BY-SA 4.0
2021-01-02T11:07:29.393Z
It's hard to do that, however, it's not completely impossible. You need to figure out where those files have stored (of course you should discover that on `/var/lib/docker/`), then using some recovery tools like `undelete` to restore them.
Mohi Rostami
<docker><docker-swarm>
Retrieve files deleted after Docker service rm
Dilpreet Juneja
# Retrieve files deleted after Docker service rm

(Asked by: username_0 on 2020-12-29)

I had to, so I removed a service with docker service rm but I forgot to get the log files of the service. Now I am not able to find those. Can anyone help me or suggest to me if and how can I get those log files. I was using json-files driver for logging via yml.

**Tags:** docker, docker-swarm

> **Comments:**
> **username_1**: It's hard to do that, however, it's not completely impossible. You need to figure out where those files have stored (of course you should discover that on `/var/lib/docker/`), then using some recovery tools like `undelete` to restore them.  

---

## 1 answers

### Answer by username_2 on 2020-12-29. Score: 1

There's no special feature to undelete files on the host provided by docker. So if you delete your files using docker, you are left with the same option as when you delete on Linux without using docker:

1. Learn from your mistake and don't do it again (I'd recommend forwarding logs to an external log aggregator).
2. Restore from backup.
3. Do a forensic recovery of the hard drive contents.


---

