Restore RM command in Ubuntu mistakenly delete file

Computer system: Ubuntu 16.04

1 Background

When doing the project, originally wanted to use the RM command to delete a file beginning with 14, the result is written as follows:

[CPP]View PlainCopy

1. RM 14 *

Note that there should be no space between 14 and *, but mistakenly write a space, resulting in all files are deleted! In order to retrieve the files that were mistakenly deleted, we explored them according to some information on the Internet.

2 Ext3grep

[CPP]View PlainCopy

1. sudo apt-get install Ext3grep

The use of this tool in reference [4] has a more detailed description of the process. However, as mentioned in reference [5], this tool is only suitable for ext3 file systems, and the new Ubuntu system generally uses the ext4 file system, so you need to use other tools such as extundelete.

3 Extundelete

[CPP]View PlainCopy

1. sudo apt-get install Extundelete

Using this tool, I succeeded in recovering files that were mistakenly deleted using the RM command. For information on how to use this tool, see reference [7]. The following is a simple record of the reply process.

[CPP]View PlainCopy

1. sudo extundelete/dev/sda1--restore-all

Description:/DEV/SDA1 is the partition where the file was mistakenly deleted. My mistakenly deleted file was originally in a subdirectory inside/home/liyihai, and this directory is attached to the/DEV/SDA1 partition (viewed using the df-h command).

After executing the above command, a directory named Recovered_files is generated in the current directory, and the recovered files are placed in this directory.

According to reference [7], the recovered file is renamed, so you need to use the grep command to find the file you want based on the contents of the file.

Resources

[1]linux How to recover the RM command deleted files

[2]linux RM File Recovery Summary
[3] Linux usage notes: Practical ext3grep Recovery Directory and Documentation Guide (ext3 file system)

[4]ubuntu used Ext3grep to recover files mistakenly deleted in Ext3 file system

[5] Issue: How to recover deleted files under EXT4 partition

[6] Data mistakenly deleted under Linux is no longer a horrible thing, ext3grep to help you recover

[Recovery of deleted files in 7]EXT4 partition

[8] Recover files mistakenly deleted on Linux EXT4 partition

[9] "Linux" Linux system ext4 format delete File recovery: Extundelete

Restore RM command in Ubuntu mistakenly delete file (go)