Linux RM Command Recovery (grep) by deleting files incorrectly

using the Extundelete plugin

Suppose the deleted file is located in the/media/backup, and the mounted device is/DEV/SDA3.

First, mount the current disk again.

Then install the Extundelete dependent package,

The code is as follows	Copy Code
sudo aptitude install e2fsprogs E2fslibs-dev

Download Extundelete,
Decompression Extundelete,
Run

Three big strides

The code is as follows	Copy Code
./configure Make sudo make install

You can extundelete--help look at the usage, or simply restore Extundelete/dev/sda3--restore-all Note that the restored file is located in the recovered_files where the software folder is installed.

Instance

grep Recover Delete File

Temporarily build a text file Vpsee.log do the test, and then delete this file:

The code is as follows	Copy Code
$ echo "Important log file for vpsee.com" > Vpsee.log $ cat Vpsee.log Important log file for vpsee.com $ RM Vpsee.log

If you can remember just deleting a keyword in a file, you can use grep to search through the entire/DEV/SDA1,-A flag to think of the/dev/sda1 as a textual form (the partition itself is in binary form),-B 10-a 100 If you find the keyword, print out the first 10 lines and the last 100 lines:

The code is as follows	Copy Code
# grep-a-B 10-a ' vpsee.com '/dev/sda1 > Tmp.txt

You can find what we just deleted in a bunch of @:

The code is as follows	Copy Code
$ VI Tmp.txt ... @$^@^@^@^@^@^@^@^@^@^@^@^a^@^@^@^@^@^@^@?^@^@^@^a^@^@^@^@^@^@^@^@^@^@^@è^k^@^@^@ ^@^@^@^@^@^@^@^@^@^@^@^a^@^@^@^@^@^@^@^q^@^@^@^c^@^@^@^@^@^@^@^@^@^@^@è^k^@^@x^@ ^@^ @important log file for vpsee.com @ @ ...

Of course, if you mistakenly delete the binary, doc, png/jpg/gif and other files, you can use some Third-party ext2/ext3 File Recovery tool to help recover files, such as TestDisk, PhotoRec.