Restore RM deleted data under Ubuntu

1. On the importance of "backup"

Today's hand really fast, tab fill full file name after the return, yesterday Day wrote the code was I remove. Although I wrote a script to back up the system and the home directory, but the system is a 1-day backup, home is a 2-day incremental backup. Also happened to have not backed up home last night, and Git did not submit, want to cry without tears feeling 5555~~.

The removed file is actually recoverable, and the delete command just deletes the tag in the file node, not the actual empty content , but other users and some processes that have write-action will quickly overwrite the data. So to recover disk information, you must immediately stop any write disk operations .

I am to uninstall the entire disk down, with the wiring to hang the classmate notebook to restore success, the following will describe the specific recovery process. 2. Introduction to Recovery Tools

For the Ext file system under Linux, the commonly used deletion and recovery tools are Debugfs, Ext3grep, Extundelete and so on. Extundelete is an Open-source data recovery tool that supports ext3, ext4 file systems.

My system is Ubuntu15.04 and the file system is EXT4. Tried the Debugfs to recover, but did not succeed. If the file system is not EXT4 students can try this way, here is a reference document. 3. Extundelete Recovery Documents

Install Extundelete

sudo apt-get install Extundelete        

Any File recovery tool to uninstall or mount the restored partition as read-only before using it, preventing data from being overwritten.

UMOUNT/DEV/SDB2 
Mount-o REMOUNT,RO/DEV/SDB2

If the deleted file and the operating system are on the same partition, only the hard drive is unloaded and mounted on another host. That's what I do, ^_^.

View the mount partition with Df-h on another host. My partition is/DEV/SDB2.

Executing on this host:

EXTUNDELETE/DEV/SDB2--restore-file/home/zhangchengfei/server.scala

After the extundelete is executed, a recovered_files directory is produced in the current directory, which is the recovered file.

If you want to recover the contents of a folder, you can use the following command:

EXTUNDELETE/DEV/SDB2--restore-directory/hom/zhangchengfei/tmp

More details about Extundelete can be viewed using extundelete-h, which is no longer described in this article. 4. Lessons learned

In fact, good backup and synchronization habits are the most important, absolutely easier than recovering data. Common backup strategies are tar,rsync,git and so on. To prevent RM from deleting data in the future, there is a way to redefine RM itself, each time not deleting files or folders directly, but move them to a directory you specify. The implementation of the specific can be Google search.

Read this blog friend must have met the same dilemma as me, good luck O (∩_∩) o~~

Finish