In the ext2 File System on linux, debugfs is used to restore deleted files.

In the ext2 File System on linux, debugfs is used to restore the deleted file-Linux Enterprise Application-Linux server application information. The following is a detailed description. If you accidentally use rm-rf xxx to delete a file or the entire directory, it can be restored on the ext2 file system. Because the file data is not actually deleted, but the index is deleted, the file creation, modification, and other file operations should be stopped immediately after the file is accidentally deleted, because they may overwrite the disk space occupied by previously deleted files, they cannot be recovered.

If there is only one file, run:

Debugfs/dev/sda2; // dev/sda2 is the device you want to view
> Lsdel // view the inode of the deleted file, which is generally the last one. Of course, you can determine it based on the different properties of lsdel.
> Dump Dst_file_path // inode indicates the specific inode value. dst_file_path must be a specific file name.

If you delete a large number of files, the operation is very troublesome. If you enter the debugfs interaction mode, only one file can be restored at a time. If you delete 1 million files, you cannot perform operations one by one. Debugfs has a-f parameter to solve this problem.-f indicates that a command file can be passed in for debugfs to execute.

First create a file export:
Echo "lsdel"> export;

Then run debugfs-f export/dev/sda2. At this time, all deleted files are output
Inode Owner Mode Size Blocks Time deleted

And all these are not necessarily the files you want to restore. You can use grep to filter them according to your own needs. For example, I want to restore uid = 1 user today (10) delete a file whose size is not 0 at. The specific operation command is as follows:

Debugfs-f export/dev/sda2 | grep '1' | grep '10 12: '| grep-v '0' | awk' {print "dump <" $1 ">" $1 ". del "} '> cmd

This results in a lot of dump Run the dst_file_path command to store the cmd file, and then call debugfs-f cmd/dev/sda2 to restore the desired file.

If the system has multiple disks, it is best to restore files from one disk to another. Otherwise, the inode that has not started dump may be overwritten during dump.