Linux restore mistakenly delete files-extundelete

after I tested the tool supports EXT3 and Ext4 file systems

When the data of a partition is found to be deleted by mistake, the first thing to do is to immediately unload the partition where the file was deleted, or to mount the partition again in read-only mode.

The reason for this is simple: Deleting a file removes the sector pointer from the Inode node and frees the data block for the data, and the real file remains in the disk partition. However, these deleted files do not necessarily persist on the disk, and when the freed blocks are reassigned by the operating system, the deleted data is overwritten. Therefore, when the data is mistakenly deleted, unmount the partition of the file immediately can reduce the data in the data block the risk of overwriting, and thus improve the chances of successful recovery of data.

1. Creating a file System
[Email protected]_test_26_74/]# mkfs-t ext4/dev/sdb3

2. View the file system type
[[Email protected]_test_26_74/]# blkid/dev/sdb3--View file system type
/dev/sdb3:uuid= "b786e8d1-e8ac-4681-ad3a-ff7a39c07146" type= "Ext4"

You can also use the following methods to view
[Email protected]_test_26_74 ~]# file-s/dev/sdb3
/dev/sdb3:linux Rev 1.0 ext4 FileSystem data (extents) (huge files)

3. Create a delete directory and mount it to the file system you just created, create the file, and then delete the file

[[Email protected]_test_26_74/]# mkdir Delete
[Email protected]_test_26_74/]# Mount/dev/sdb3/delete
[Email protected]_test_26_74/]# Cd/delete
[[Email protected]_test_26_74 delete]# ls
Lost+found
[[Email protected]_test_26_74 delete]# VI zw.txt--add some content
[Email protected]_test_26_74 delete]# RM-RF zw.txt

4. Download
Extundelete Home: http://extundelete.sourceforge.net/
: http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2--0.2.4 version

[Email protected]_test_26_74/]# wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/ extundelete-0.2.4.tar.bz2

[Email protected]_test_26_74/]# TAR-XVF extundelete-0.2.4.tar.bz2

[Email protected]_test_26_74 extundelete-0.2.4]# cd/extundelete-0.2.4

[Email protected]_test_26_74 extundelete-0.2.4]#/configure--prefix=/usr/local/extundelete && Make & & Make Install
Configuring Extundelete 0.2.4
Configure:error:Can ' t find ext2fs Library

This is because Extundelete relies on e2fsprogs.

[Email protected]_test_26_74 extundelete-0.2.4]# yum-y Install e2fsprogs e2fsprogs-devel

After installing E2fsprogs, configure success again.


[Email protected]_test_26_74 extundelete-0.2.4]#/configure--prefix=/usr/local/extundelete && make && Amp Make install
Configuring Extundelete 0.2.4
Writing generated files to disk
Make-s all-recursive
Making All in SRC
Making Install in SRC
/usr/bin/install-c ' extundelete '/usr/local/bin/extundelete '

5. View the tool version
[Email protected]_test_26_74/]# Cd/usr/local/extundelete/bin
[Email protected]_test_26_74 bin]#./extundelete-v
Extundelete version 0.2.4
LIBEXT2FS version 1.41.12
Processor is little endian.

6. Unmount the partition, note if the/root directory is deleted, mount the disk to another machine to do the recovery

[[Email protected]_test_26_74 ~] fuser-k/delete <--end of process tree using a partition
[[email protected] ~]# umount/delete <--unmount partition
[Email protected]_test_26_74 ~]# umount/dev/sdb3

7. Use Extundelete to view files that exist on the partition
Extundelete--inode 2/DEV/SDB2
#--inode to find content in an I node, use 2 for search, and if you need to go to directory search, just specify the directory I node

[Email protected]_test_26_74 bin]# extundelete--inode 2/dev/sdb3
warning:extended attributes is not restored.
Loading FileSystem metadata ... Groups loaded.
Contents of Inode 2:
0000 | Ed at 7b C6 7b C6 56 |, XX A....... {. v.{. V
0010 | 7b C6 56 00 00 00 00 00 00 03 00 02 00 00 00 |. {. V............
0020 | XX E3 10 00 00 00 00 00 00 | .... ...........
0030 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0040 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0050 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0060 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
0070 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................

Inode is allocated
group:0
File mode:16877
Low + bits of Owner uid:0
Size in bytes:1024
Access time:1455848193
Creation time:1455848197
Modification time:1455848197
Deletion time:0
Low-bits of Group id:0
Links Count:3
Blocks Count:2
File flags:0
File version (for NFS): 0
File acl:0
Directory acl:0
Fragment address:0
Direct blocks:4323, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
Indirect block:0
Double Indirect block:0
Triple Indirect block:0

File name | Inode number | Deleted status
Directory Block 4323:
. 2
.. 2
Lost+found 11
Zw.txt Deleted
. ZW.TXT.SWP Deleted
zw.txt~ Deleted


It's marked as deleted, and zw.txt is the data I accidentally deleted.


8. Recovery:
[Email protected]_test_26_74 bin]# extundelete--restore-all/dev/sdb3
warning:extended attributes is not restored.
Loading FileSystem metadata ... Groups loaded.
Loading Journal Descriptors ... Descriptors loaded.
Writing Output to directory recovered_files/
Searching for recoverable inodes in directory/...
1 recoverable inodes found.
Looking through the directory structure for deleted files ...
Restored Inode to file Recovered_files/zw.txt
0 recoverable inodes still lost.
[Email protected]_test_26_74 bin]# LL
Total 1164
-rwxr-xr-x 1 root root 1187047 Feb 10:10 extundelete

Drwxr-xr-x 2 root root 4096 Feb 11:20 recovered_files

[Email protected]_test_26_74 bin]# CD recovered_files/

[[email protected]_test_26_74 recovered_files]# ll
Total 4
-rw-r--r--1 root root 11:20 < Span style= "font-family:"courier new"; font-size:18px; Color:rgb (255, 0, 0); " >zw.txt

You can see that the zw.txt has been restored to the Recovered_files directory.

9. Extended command:
--restore-inode 12               #--restore-inode Restore
--restore-file by the specified I node zw.txt            #--restore-file Restore
--extundelete--restore-all     # By the specified file name #- -restore-all  is the full restore, the default is all the recovered files are placed in the current path recovered_files/directory, file name. I node number

Note: The Recovered_files directory is generated under the directory of the current execution command!

Linux restore mistakenly delete files-extundelete