Recover mistakenly deleted files under Linux

Original address: http://www.libenfu.com/vim-partition under the deleted file, recover file full record-turn

At that time, my working directory was /source/needrecovered .

pwd/source/needrecovered

Originally intended to empty one of the sub-files,

$ rm -rf canbedeleted/html

The command is called as follows:

$ rm -rf canbedeleted/ *

I was wondering how to delete a small folder so slowly today. When I took a closer look at the order, it was too late to react, and the entire working directory was emptied.

There is no way, can only go to the Internet to find solutions, the online roughly mentioned methods have two kinds: one is to use debugfs , the second is to use ext3grep .

The first method, I tried a number of times to fail, the second success. But the same is the case: the first two methods mentioned are the application of the operation of the partition is all closed first, as follows:

The following actions are used as much as possible root to improve the success rate of data recovery.

#该命令用于列出操作该分区的进程fuser -v -m /source#如果没有很重要的进程，利用下面的命令将其全部 kill 掉fuser -k -v -m /source

When executing the above command, be sure to switch your working directory /source outside or you sshd will be kill dropped.

There are two benefits to be achieved in this way

1) Prevent new file operations from affecting data recovery

2) To facilitate further operation of the disk or partition, such as: mount andumount

Next we look at the disk partitioning:

$ df -ThFilesystem    Type    Size  Used Avail Use% Mounted on/dev/sda8     ext3    7.9G  6.3G  1.2G  84% /source/dev/sdb1  fuseblk    299G 266G 33G 90% /data/

The partition that needs to be recovered is /dev/sda8 , the mount point is /source .

This partition is first unloaded and /data a folder is established on the partition to store the backup data.

umount -v /sourcemkdir -p /data/recovery

Now it's the protagonist's turn, download a copy ext3grep of the source code, and install:

cd /data/recovery#此链接地址以官网最新版本为准wget http://ext3grep.googlecode.com/files/ext3grep-0.10.2.tar.gztar xfz ext3grep-0.10.2.tar.gzcd ext3grep-0.10.2./configure --prefix=/data/recoverymake && make install

The next step is to go through the formal recovery process, first scanning the disks that need to be recovered.

cd /data/recoverynohup /data/recovery/bin/ext3grep /dev/sda8 --ls --inode 2 &#建议使用 nohup 和 &，因为如果分区很大的话耗时比较长

After the scan is complete, /data/recovery there will be two files named c0d2.ext3grep.stage1 and in each c0d2.ext3grep.stage2 . The former can be ignored directly, the latter holds the file name that can be restored back up.

Since I need to back up a lot of files, dozens of G, use the following command for full recovery.

cd /data/recoverynohup /data/recovery/ext3grep/bin/ext3grep /dev/sda8 --restore-all &#建议使用 nohup 和 &，因为如果分区很大的话耗时比较长

Note that the restore-all parameter restores and backs up all files of the entire disk (deleted recoverable files and files that have not been deleted), so make sure you have enough space for the partition where the recovered files are stored.

If only a few files are recovered, it is recommended that restore-file the files backed up with parameters be stored in the folder named in the working directory RESTORED_FILES , which is in this article cd /data/recovery/RESTORED_FILES .

Recover mistakenly deleted files under Linux