Extundelete is a tool for recovering ext3, EXT4 partition files. It uses log information from the partition to try to recover the deleted files. However, not every deleted file is guaranteed to be restored, so it is important to develop good backup habits.
extundelete How to recover files
When recovering a file, Extundelete obtains information about all the files under the current filesystem, including the file name and the Inde, through the file system's Inode information (the inode of the root directory is typically 2). Then the inode information is used to query the block location of the inode, including the direct block, indirect block and other information to recover the data file.
Install and test
Be careful not to install Extundelete on the hard drive of the file you mistakenly deleted, so that it is possible to completely overwrite the data that needs to be recovered, and immediately mount the partition to be recovered, such as #umount/dev/sdb1
(1) Preparing the installation package
Extundelete-0.2.4.tar
(2) Install the compilation environment
Yum install gcc gcc-c++-y
(3) Install dependent packages
RPM-IVH e2fsprogs-libs-1.41.12-18.el6.x86_64.rpm
RPM-IVH e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm
RPM-IVH e2fsprogs-devel-1.41.12-18.el6.x86_64.rpm
(4) Unzip the installation package to/opt
Tar jxvf extundelete-0.2.4.tar.bz2-c/opt
(5) configuration
Cd/opt/extundelete-0.2/
./configure
(6) Compile and install
Make && make install
(7) test
Use the FDISK command to create a partition/dev/sdb1, mount it to/tmp, and add a new file or directory to the/tmp directory
Simulate misoperation (delete files) and restore
The/DEV/SDB1 partition will be mounted immediately after the accidental deletion and the recovery data will be resumed, then the /recovered_files directory appears in the current directory, which is the recovered file.
In particular, Extundelete will fail to recover some blank folders or empty files.
Recover data mistakenly deleted with Extundelete in Linux
