Restore Rm-RF files in Linux ext3 ext4 by mistake

Today, Rm-RF. * deleted an important email directory. Fortunately, it was restored through extundelete.
Write down the operation process:
1. Preparations
Mainly throughExtundelete 0.2.0 Recovery completed
Dependent on two packages

Sudo aptitude install e2fsprogs e2fslibs-dev

Download PageHttp://extundelete.sourceforge.net/

Quick download:Download extundelete

 

Tar-xjf extundelete-0.2.0.tar.bz2

CD extundelete-0.2.0

Compile Trilogy

./Configure
Make
Sudo make install

 

2. If the partition has been mounted, umount first and check the space size in the location to be restored.

DF-H ./

File System 1 K-block used available % mount point
/Dev/sda3 18129292 2651744 14541764 16%/
/Dev/sda1 194442 12197 172206 7%/boot

...

YesUmount/home !!!

If you want to restore the root directory or system directory, you only need to attach the hard disk to another computer.

3. Restore all deleted files under the specified partition and restore them to the directory where the command is executed by default. The folder name is recovered_files. For details, see: extundelete -- help running result.

 

 

Restore an accidentally deleted file in/dev/sda3

 

 

Extundelete/dev/sda3 -- restore-file/AN/important/File

 

Restore A accidentally deleted folder in/dev/sda3

Extundelete/dev/sda3 -- restore-directory/AN/important

Eg: grant/workspaces /...

 

Restore all deleted items in/dev/sda3

Extundelete/dev/sda3 -- restore-all

[Root @ yznvm1 yzn] # extundelete /Dev/sda3   -- Restore-File /Home/yzn/helloworld/makefile. AM
Warning: extended attributes are not restored.
Warning: ext3_feature_incompat_recover is set.
The partition shoshould be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
It was improperly unmounted, And You shoshould run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
Files And make recovering those files impossible. You shoshould unmount
File System and check it with fsck before using extundelete.
Wocould you like to continue? (Y/N)
Y
Loading filesystem metadata... 143 groups loaded.
Loading journal descriptors... 29535 descriptors loaded.
Writing output to directory recovered_files/
Restored inode 4223596 to file recovered_files/home/yzn/helloworld/makefile. AM

 

OK.

Of course, the file cannot be restored successfully. Another file is garbled and inode cannot be found when an error is reported.

 

Umount:/Home: device is busy,

The reason is thatProgramIn the/home directory, we can use Fuser to view the processes of those programs,

And then you can kill it.

[Root @ localhost Home] # Fuser-M/home

/Home: 10278c 10279c 10280c 10281c 10282c 10295 10365 18222c

Command: Kill-9 PID

 

$ Fuser-m-V/Media/USB/
User Process Code permission command
/Media/bak/: galeki 335 .. c .. gqview

-The M parameter shows all the processes that use the specified file system, which can be followed by the mount point or Dev device (Thanks lisir:), The-V parameter provides detailed output. It can be seen that gqview is still occupying mobile devices. Fuser also gives the process Number of the program and knows the process number, you can handle this program as you like.

You can also add a-k parameter:

Fuser-m-k/Media/USB/

This action automatically kills programs that occupy/Media/USB. If you do not know whether to kill all programs that occupy the device, you can add a-I parameter so that each time you kill a program, you will ask:

$ Fuser-m-v-I-k/Media/bak/
User Process Code permission command
/Media/bak/: galeki 371 .. c .. gqview
Killing process 371? (Y/N)

It solved the problem of "device is busy" very smoothly ~

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!

Or umount-L/data1 ..