Sunday, March 2, 2014

Undeleting Files that were accidentallly deleted

How to undelete files from ext3/ext4 partition
When you accidentally delete a file or files or an entire directory extundelete can recover them for you.

yum install extundelete

The first step should be to  unmount the partition that your lost files are on, as soon as possible.
If you know the path and the name of the file or directory  (let's assume it's /home/cgerada/Music/ and you accidentally deleted all your music files .
sudo to root
sudo -i or su - root and go to a partition with enough free space to store the deleted files. Then:

extundelete --restore-files /home/cgerada/Music/ /dev/sda3

you should get the following
NOTICE: Extended attributes are not restored.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates 
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible.  You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n) 
type y
Loading filesystem metadata ... 3679 groups loaded.
Loading journal descriptors ... 31276 descriptors loaded.

As soon as extundelete is  finished, you will  find the recovered files  in the folder you were in when you ran the command  /RECOVERED_FILES/

If you deleted  a  directory itself, you can use --restore-directory

There are some other  useful options such as  --restore-all , --restore-file, --after 'dtime' or --before 'dtime'

type extundelete --help  to see exactly what the other options do.

No comments: