My *nix world

Undelete files on Linux

To continue my series of "Oops i did it again" I would like to explain few methods that allows you to undelete files on Linux.

One of the fastest and easiest method I found so far is with the help of Extundelete utility that works only for ext3 and ext4 partitions.

If you delete by mistake a file like ~/Documents/src/myfile.txt that resides on /dev/sdc2 partition then all you have to do is just to run a command like the one below:

extundelete --restore-file ~/Documents/src/myfile.txt /dev/sdc2

This will create a RECOVERED_FILES directory where all the recovered files are stored using the whole restore path (i.e. <root>.../Documents/src/myfile.txt).

Another simple solution is DebugFS utility that allows you to debug a file system, including recovering the deleted inodes/files.

If you want to recover the same file like the one mentioned earlier you could do like this:

debugfs /dev/sdc2
debugfs: ls
debugfs: cd /path-to-deleted-file
debugfs: lsdel
debugfs: dump <123456> /tmp/recovered.txt
debugfs: quit

 What this does, step by step, is:

  • connect to the device /dev/sdc2
  • list the current directory (probably the root of /dev/sdc2)
  • change the current directory within /dev/sdc2 to my path-to-deleted-file
  • list deleted files; it will present me a list of the deleted inodes
  • once I found the inode I am interested I will dump its content to a file on the local mounted partition
  • quit the utility

Two other programs that you can use are Testdisk and PhotoRec. You can read my experience with these here. Consider also using the e2undel utility.

Now, if you think that this article was interesting don't forget to rate it. It shows me that you care and thus I will continue write about these things.

The following two tabs change content below.
Undelete files on Linux

Eugen Mihailescu

Founder/programmer/one-man-show at Cubique Software
Always looking to learn more about *nix world, about the fundamental concepts of math, physics, electronics. I am also passionate about programming, database and systems administration. 16+ yrs experience in software development, designing enterprise systems, IT support and troubleshooting.
Undelete files on Linux

Latest posts by Eugen Mihailescu (see all)

Tagged on:

Leave a Reply

Your email address will not be published. Required fields are marked *