Restore a Linux rm command to accidentally delete a file (grep)

This article introduces two methods to restore the accidental deletion of files by using the Linux rm command. One is to use extundelete and the other is to use grep.

Use the extundelete plug-in

Assume that the deleted file is in/media/backup, and the mounted device is/dev/sda3.

First, Remount the current disk.

Then install the extundelete dependent package,

The Code is as follows:	Copy code
Sudo aptitude install e2fsprogs e2fslibs-dev

Download extundelete,
Decompress extundelete,
Run

Three stride

The Code is as follows:	Copy code
./Configure Make Sudo make install

You can use extundelete -- help to check the usage, or restore all extundelete/dev/sda3 -- restore-all. Note that the recovered files are stored in RECOVERED_FILES on the software folder.

Instance

Grep restore and delete files

Create a text file vpsee. log for testing, and then delete the file:

The Code is as follows:	Copy code
$ Echo "important log file for vpsee.com"> vpsee. log $ Cat vpsee. log Important log file for vpsee.com $ Rm vpsee. log

If you can remember a keyword in the deleted file, you can use grep to search for the entire/dev/sda1, -The a flag indicates that the/dev/sda1 partition is in the text format (the partition itself is in the binary format ), -B 10-A 100 means that if the keyword is found, the content of the first 10 rows and the last 100 rows will be printed:

The Code is as follows:	Copy code
# Grep-a-B 10-A 100 'vpsee. com'/dev/sda1> tmp.txt

Find the content we just deleted between a bunch:

The Code is as follows:	Copy code
$ Vi tmp.txt ... @ $ ^ @ ^ A ^ @? ^ @ ^ A ^ @ ^@è ^ K ^ @ ^ @ ^ A ^ @ ^ Q ^ @ ^ C ^ @ ^ @è ^ K ^ @ × ^ @ ^ @ Important log file for vpsee.com @ @ ...

Of course, if files such as binary files, doc files, png files, jpg files, and gif files are accidentally deleted, you can use some third-party ext2/ext3 file restoration tools to help restore files, such as TestDisk and PhotoRec.