Restore accidentally deleted files in Linux

I used to see a lot of questions on the Internet about how to restore files accidentally deleted in Linux partitions. I did not pay close attention to it at that time. I did not expect it to be shared with me yesterday. Let's talk about the whole process of this tragedy (to avoid unnecessary troubles, the folder name and device name in this article have been modified). at that time, my working directory was/source/needrecov.

I used to see a lot of questions on the Internet about how to restore files accidentally deleted in Linux partitions. I did not pay close attention to it at that time. I did not expect it to be shared with me yesterday.

Let's talk about the whole process of this tragedy (to avoid unnecessary troubles, the folder name and device name in this article have been modified)

At that time, my working directory was/source/needrecovered.

$ Pwd
/Source/needrecovered

Originally intended to clear a sub-file

But the command is wrong.

At that time, I wondered how to delete a small folder so slowly today. It's too late for me to take a closer look at the command. The entire working directory is cleared.

You can only find a solution on the internet. There are two methods mentioned on the Internet: debugfs and ext3grep. The first method, I tried several times and ended in failure. The second method succeeded. However, the two methods are uniform: first, all applications that operate on the partition are closed, as shown below:
Use the root operation as much as possible to improve the success rate of data recovery.

# This command is used to list the processes that operate the partition.
Fuser-v-m/source
# If there are no important processes, kill them all with the following command
Fuser-k-v-m/source

When executing the preceding command, you must switch your working directory to a directory other than/source. Otherwise, your sshd will be killed.

In this way, two benefits can be achieved:

Prevents new file operations from affecting data recovery

Facilitate further operations on disks or partitions
For example, mount and umount

Next, let's take a look at the disk partition information.

$ Df-Th
Filesystem Type Size Used Avail Use % Mounted on
/Dev/sda8 ext3 7.9G 6.3G 1.2G %/source
/Dev/sdb1 fuseblk 299G 266G 33G %/data/

The partition to be restored is/dev/sda8, and the Mount point is/source.

Unmount the partition and create a folder for storing backup data in the/data partition.

Umount-v/source
Mkdir-p/data/recovery

Now it's the turn of the main character. first download an ext3grep source code and install it.

Cd/data/recovery
# This link is based on the latest official website version.
Wget http://ext3grep.googlecode.com/files/ext3grep-0.10.2.tar.gz
Tar xfz ext3grep-0.10.2.tar.gz
Cd ext3grep-0.10.2
./Configure -- prefix =/data/recovery
Make
Make install

Next, we enter the formal recovery work. we will first scan the disk to be restored.

Cd/data/recovery
Nohup/data/recovery/bin/ext3grep/dev/sda8 -- ls -- inode &
# Nohup and & are recommended because it takes a long time to partition

After scanning,/data/recovery will show two files named c0d2. ext3grep. stage1 and c0d2. ext3grep. stage2 respectively. The former can be ignored directly, while the latter saves the file name that can be recovered.

Because I need to back up a lot of files, dozens of GB, use the following command to restore all

Cd/data/recovery
Nohup/data/recovery/ext3grep/bin/ext3grep/dev/sda8 -- restore-all &
# Nohup and & are recommended because it takes a long time to partition

Note that the restore-all parameter restores and backs up all files on the disk (deleted files that can be recovered and files that are not deleted, so make sure that you have enough space for storing the recovered file partition.

We recommend that you use the restore-file parameter to restore only a few files.
The backup files will be stored in the folder named RESTORED_FILES in the working directory. in this article, cd/data/recovery/RESTORED_FILES

The last sentence is to use rm-rf with caution.