To continue my series of "Oops i did it again" I would like to explain few methods that allows you to undelete files on Linux.
One of the fastest and easiest method I found so far is with the help of Extundelete utility that works only for ext3 and ext4 partitions.
If you delete by mistake a file like ~/Documents/src/myfile.txt that resides on /dev/sdc2 partition then all you have to do is just to run a command like the one below:
extundelete --restore-file ~/Documents/src/myfile.txt /dev/sdc2
This will create a RECOVERED_FILES directory where all the recovered files are stored using the whole restore path (i.e. <root>.../Documents/src/myfile.txt).
Another simple solution is DebugFS utility that allows you to debug a file system, including recovering the deleted inodes/files.
If you want to recover the same file like the one mentioned earlier you could do like this:
debugfs /dev/sdc2 debugfs: ls debugfs: cd /path-to-deleted-file debugfs: lsdel debugfs: dump <123456> /tmp/recovered.txt debugfs: quit
What this does, step by step, is:
- connect to the device /dev/sdc2
- list the current directory (probably the root of /dev/sdc2)
- change the current directory within /dev/sdc2 to my path-to-deleted-file
- list deleted files; it will present me a list of the deleted inodes
- once I found the inode I am interested I will dump its content to a file on the local mounted partition
- quit the utility
Now, if you think that this article was interesting don't forget to rate it. It shows me that you care and thus I will continue write about these things.