How to undelete files from ext3/ext4 partition
When you accidentally delete a file or files or an entire directory extundelete can recover them for you.
yum install extundelete
The first step should be to unmount the partition that your lost files are on, as soon as possible.
If you know the path and the name of the file or directory (let's assume it's /home/cgerada/Music/ and you accidentally deleted all your music files .
sudo to root
sudo -i or su - root and go to a partition with enough free space to store the deleted files. Then:
type
extundelete --restore-files /home/cgerada/Music/ /dev/sda3
you should get the following
NOTICE: Extended attributes are not restored.
WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set.
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible. You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
type y
y
Loading filesystem metadata ... 3679 groups loaded.
Loading journal descriptors ... 31276 descriptors loaded.
As soon as extundelete is finished, you will find the recovered files in the folder you were in when you ran the command /RECOVERED_FILES/
If you deleted a directory itself, you can use --restore-directory
There are some other useful options such as --restore-all , --restore-file, --after 'dtime' or --before 'dtime'
type extundelete --help to see exactly what the other options do.
No comments:
Post a Comment