To continue my series of "Oops i did it again" I would like to explain few methods that allows you to undelete files on Linux.
One of the fastest and easiest method I found so far is with the help of Extundelete utility that works only for ext3 and ext4 partitions.
If you delete by mistake a file like ~/Documents/src/myfile.txt that resides on /dev/sdc2 partition then all you have to do is just to run a command like the one below:
extundelete --restore-file ~/Documents/src/myfile.txt /dev/sdc2
This will create a RECOVERED_FILES directory where all the recovered files are stored using the whole restore path (i.e. <root>.../Documents/src/myfile.txt).
Another simple solution is DebugFS utility that allows you to debug a file system, including recovering the deleted inodes/files.
If you want to recover the same file like the one mentioned earlier you could do like this:
debugfs /dev/sdc2 debugfs: ls debugfs: cd /path-to-deleted-file debugfs: lsdel debugfs: dump <123456> /tmp/recovered.txt debugfs: quit
What this does, step by step, is:
- connect to the device /dev/sdc2
- list the current directory (probably the root of /dev/sdc2)
- change the current directory within /dev/sdc2 to my path-to-deleted-file
- list deleted files; it will present me a list of the deleted inodes
- once I found the inode I am interested I will dump its content to a file on the local mounted partition
- quit the utility
Two other programs that you can use are Testdisk and PhotoRec. You can read my experience with these here. Consider also using the e2undel utility.
Now, if you think that this article was interesting don't forget to rate it. It shows me that you care and thus I will continue write about these things.
Eugen Mihailescu
Latest posts by Eugen Mihailescu (see all)
- Dual monitor setup in Xfce - January 9, 2019
- Gentoo AMD Ryzen stabilizator - April 29, 2018
- Symfony Compile Error Failed opening required Proxies - January 22, 2018