Restore accidentally deleted files in CentOS

Restore accidentally deleted files in CentOS

In CentOS, if a file is accidentally deleted, perform the following steps to restore the file.

1. Disable all services

When a file is accidentally deleted, in order to restore data as much as possible, you must first disable all ongoing services and do not write data. Otherwise, the probability of recovery is lower. We can directly

# Killall process name

Or

# Kill-9 pid

Then, re-mount the partition where the deleted file is located to read-only

# Mount-o ro/dev/sdb/data/

2. Install the extundelete Tool

# Yum install-y e2fsprogs * // install the dependency package

# Wgethttp: // response

# Tar-jxvf extundelete-0.2.4.tar.bz2

# Cd extundelete-0.2.4

#./Configure -- prefix =/usr/local/extundelete
# Make & make install

3. verify whether the installation is successful

# Cd/usr/local/extundelete/bin
#./Extundelete-v
---------------------
Extundelete version 0.2.4
Libext2fs version 1.41.12
Processor is little endian.
---------------------

4. Restore data

Example: If we accidentally delete the file test.txt, the partition is/dev/sdb.
1) scan files
#/Usr/local/extundelete/bin/extundelete/dev/sdb -- inode 2 // scan which files are deleted
2) Restore Files

#/Usr/local/extundelete/bin/extundelete -- restore-file test.txt/dev/sdb

3) view files
The recovered files are stored in the RECOVERED_FILES/directory of the current directory.
# Ls./RECOVERED_FILES/

You can see the test.txt file.

Note:

To restore files in the entire partition, run the following command:
#/Usr/local/extundelete/bin/extundelete -- restore-all/dev/sdb
The recovered files are also in the./RECOVERED_FILES/directory.

5. Follow-up work

1) Remount the partition to writable.
2) Back up important data.
3) overwrite the recovered data.
4) restart the server to restore services that have been previously disabled.