Ubuntu 16.04 using RM-RF deleted File Recovery method collection

Description: Not necessarily effective, need to keep trying

First, lsof

The file has just been deleted and you want to restore it, try Lsof first.

lsof | grep Data.file1 CP /proc/xxx/xxx/xx  /dir/data.file1

If the lsof cannot see the file, then recovery software is required to recover it. The first thing to do is to immediately unload the partition where the file was mistakenly deleted, or to mount the partition again in read-only mode.

Umount  /dev/part    or     mount -o Remount,ro/dev/part

Deleting a file is the Inode (the inode is the directory where the operating system looks for files), the sector pointers in the nodes are cleared, and the data blocks corresponding to the data are freed, and the real files remain in the disk partition. However, these deleted files do not necessarily persist on the disk, and the deleted data is overwritten when the freed blocks are reassigned by the operating system. Therefore, unmount the partition immediately.

Second, Ext3grep

sudo Install Ext3grep  

The use of this tool in reference [4] has a more detailed description of the process. However, as mentioned in reference [5], this tool is only suitable for ext3 file systems, and the new Ubuntu system generally uses the ext4 file system, so you need to use other tools such as extundelete.

Third, Extundelete

sudo Install Extundelete  

Using this tool, I succeeded in recovering files that were mistakenly deleted using the RM command. For information on how to use this tool, see reference [7]. The following is a simple record of the reply process.

sudo extundelete/dev/sda1--restore-all  

Description:/DEV/SDA1 is the partition where the file was mistakenly deleted. My mistakenly deleted file was originally in a subdirectory inside/home/liyihai, and this directory is attached to the/DEV/SDA1 partition (viewed using the df-h command).

After executing the above command, a directory named Recovered_files is generated in the current directory, and the recovered files are placed in this directory.

According to reference [7], the recovered file is renamed, so you need to use the grep command to find the file you want based on the contents of the file.

Iv./CASPER/FILESYSTEM.SQUASHFS

This is an Ubuntu CD-specific file, the uncompressed CD folder below the /casper/filesystem.squashfs file copied out to a separate folder

CD to just copy out Filesystem.squashfs folder, then open terminal input

UNSQUASHFS FILESYSTEM.SQUASHFS

Enter execution

The last step will generate a squash-boot folder, and then in the search for the system files you mistakenly deleted, in which directory to delete in the corresponding directory to find

Reference

[1]linux How to recover the RM command deleted files

[2]linux RM File Recovery Summary
[3] Linux usage notes: Practical ext3grep Recovery Directory and Documentation Guide (ext3 file system)

[4]ubuntu used Ext3grep to recover files mistakenly deleted in Ext3 file system

[5] Issue: How to recover deleted files under EXT4 partition

[6] Data mistakenly deleted under Linux is no longer a horrible thing, ext3grep to help you recover

[Recovery of deleted files in 7]EXT4 partition

[8] Recover files mistakenly deleted on Linux EXT4 partition

[9] "Linux" Linux system ext4 format delete File recovery: Extundelete

Https://www.cnblogs.com/jikexianfeng/p/7349275.html (The above sections are transferred from this article)

http://blog.csdn.net/weiguang1017/article/details/52239685 (The above sections are transferred from this article)

HTTPS://WWW.JIANSHU.COM/P/F5558050ACB1 (the above content is transferred from this article)

Ubuntu 16.04 using RM-RF deleted File Recovery method collection