Ubuntu restores deleted files

Accidentally yesterday, performed the RM xx-rf and removed a project. Then there are all kinds of remorse, all kinds of remorse, this project is a week's workload ah. Finally must solve, so Google search found the recovery artifact Extundelete, and finally successfully recovered all the deleted by my unintentional files. Thank God, thank Extundelete. The following is a summary of personal experience. How to use Extundelete

1) Download Tool Extundelete

Downloading this tool under Ubuntu is too easy.

[python] view plain copy sudo apt-get install Extundelete

2) Use

This is also very easy to use. Using the Extundelete–help command, you can tell us a lot.

[Python]  View Plain  copy itleaks@ itleaks::~$ extundelete --help   Usage:  extundelete [options] [--] device-file   options:     ...................      --after dtime          Only  process entries deleted on or after  ' Dtime ' .     --before  dtime         only process entries deleted  before  ' dtime ' .   actions:     ............     -- restore-file  ' path '   Will restore file  ' path ' .  ' path '  is relative  to root                             of the partition and  does not start with a  '/'   (it                             must be  One of the paths returned by --dump-names) .                              The restored file is created in the current                             directory as  ' Recovered_files/path ' .      --restore-files  ' path '  will restore files which are listed in  the file  ' path ' .                              each filename should be in  the same format as an option                              to --restore-file, and there should be one per line.     --output-dir  ' path '     restore files in the output  dir  ' path ' .                             By default the  restored files are created under current directory  ' RECOVERED_FILES ' .      --restore-all          attempts to  restore everything.     ...........  

We know that when we accidentally delete useful files, we are generally more likely to know the time of deletion, so the use of time this option can quickly and accurately restore the files we want. How is this dtime generated? Please refer to the following command:

[python] view plain copy itleaks@ itleaks:~$ date-d "2014-06-01 23:02:00" +%s 1401634920

%s means seconds since 1970-01-01 00:00:00 UTC, which is the time difference between entering and 1970-01-0100:00:00

You can then use this to restore the [python] view plain copy sudo extundelete/dev/sda8--after 1401634920--restore-all

Now let's do a trial: The following are the details

[python]   View plain  copy itleaks@ itleaks:/tmp$ echo  "recovery  test "> itleaks.test   itleaks@ itleaks:/tmp$ rm itleaks.test     itleaks@ itleaks:/tmp$ date -d  "2014-06-01 22:28:00"  +%s   1401632880   itleaks@ itleaks:/tmp$ sudo extundelete /dev/sda8 --after  1401632880 --restore-all   only show and process deleted entries  if they are deleted on or after 1401632880 and before  9223372036854775807.