Restore mistakenly deleted files under Linux: Thinking + Practice

Friday Basketball Group Someone asked mistakenly deleted the file how to recover, learned that it is Ext4 file system after I recommended ext4magic this tool, and then someone mentions the xfs words to do, just a few days ago to see Dave Chinner in the mailing list mentioned this problem, he recommended the tool is Xfs_ Irecover. Here's a little summary of how the deleted files in Linux can be recovered.

1. When you find that the file has been mistakenly deleted, the file system immediately uninstall, or remount into the RO state, is not to write, so that the data should not be overwritten by other data. Because most of the file system is to delete the file when the file is only marked as deleted, the data block used by the file is marked as usable, but the above data has not been cleared, the data is still in. Then this time no longer write hard disk will ensure that the data block will not be overwritten by other data, there is still hope to find back.

2. This step is optional. It is better to make a mirror of the partition to be restored, DD If=/dev/sda5 of=/path/to/image/file bs=4k, so that in the time of recovery to enjoy the mirror, even if the recovery error data is destroyed, it is also mirrored.

3. According to different file system, choose different tools to retrieve deleted files. Ext3 recommended EXT3GREP,EXT4 with Ext4magic, in fact Ext4magic is based on Ext3grep, and ext4magic can also handle EXT2/3 file system; XFS with Xfs_irecover,xfs_ Irecover's manpage is here.

4. As to how much data can be recovered, it looks like a character.

Here's an example with EXT4.

# Create EXT4 fs and copy some files there

Fallocate-l 16m ext4.img

Losetup-f--show ext4.img

Mkfs-t ext4/dev/loop0

Mount/dev/loop0/mnt/ext4

cp/mnt/ext4/

Sync

# Delete some files

rm/mnt/ext4/*

# Umount The EXT4 FS, this is important!

Umount/dev/loop0

# Make a copy of the FS

DD If=/dev/loop0 of=ext4-copy.img bs=4k

# run Ext4magic on the image

Ext4magic-m-D OutputDir ext4-copy.img

# Some sample output from the command

[Email protected]:~/workspace/src/kernel$ sudo/home/eguan/bin/ext4magic-m ext4.img-d TestDir

Warning:activate Magic-scan or Disaster-recovery function, May is some command line options ignored

"TestDir" Accept for Recoverdir

Filesystem in Use:ext4.img

Using internal Journal at Inode 8

Activ time After:sun June 7 22:43:54 2015

Activ time Before:sun June 7 23:02:18 2015

Inode 2 is allocated

Unknown code ext2 #0 for block bitmap for ext4.img

Warning:error-nr 2133571363 can not found file:/

MAGIC-1: Start lost Directory search

MAGIC-2: Start lost File search

--------Testdir/magic-2/image/jpeg/i_0000000012.jpg

--------Testdir/magic-2/image/jpeg/i_0000000013.jpg

--------Testdir/magic-2/image/jpeg/i_0000000014.jpg

MAGIC-2: Start Lost in Journal Search

MAGIC-3: Start Ext4-magic-scan Search

Ext4magic:exit_success

More ways to see Ext4magic manpage Bar, in the source package.

Read the original

Restore mistakenly deleted files under Linux: Thinking + Practice