0

Usually, the best way to recover a deleted file is to have backups and that, if the backup failed, you should immediately remount the drive read-only. (See this thread: How to recover a file just deleted )

But in some occasions, if the deleted file wasn't that important, it just would save some time to just "undelete" it.

Is there a simple way I could try on bash for the case that the deleted file on an ext4 filesystem was the only file on the disk, especially, if the disk is not used otherwise?

Community
  • 1
rubo77
  • 27,777
  • 43
  • 130
  • 199
  • Possibly related: http://unix.stackexchange.com/questions/14952/undelete-files-from-local-fileserver – slm Sep 11 '13 at 06:56
  • none of those possible duplicates show a simple solution I am looking for. Maybe it would be easy with `extundelete`? – rubo77 Sep 11 '13 at 08:12
  • That was kind of the conclusion in those Q&A's and others if you search the site. It isn't easy to do this. There are other tools I've seen such as `undelete` floating around the web. They all work some times. But you still needed to understand how the different Unix filesystems work, which defeats the point of what you're asking. – slm Sep 11 '13 at 08:17
  • I was just asking on an ext4 filesystem. I solved it now with extundelete. see my answer below – rubo77 Sep 11 '13 at 08:20
  • I figured you were ext4 but you didn't specify that originally. I believe it's reaching into the journal to do this. Some filesystems don't have a journal so it's trickier. exundelete was one of the tools I was thinking of, glad you solved your issue, good write-up! – slm Sep 11 '13 at 08:22
  • BTW, I didn't suggest this tool b/c if you search this site you'll see countless times where it had problems, so I didn't want to mislead you or others as to it's ability to do this on a consistent basis. – slm Sep 11 '13 at 08:25
  • This question is special, cause it only is safe on a disk you do not use otherwise. no other write actions on that disk. But this is often happening on backup partitions – rubo77 Sep 11 '13 at 08:28
  • I guess, I feel like I've seen this question at least a 1/2 dozen times now, I'm not sure what makes it special as you say. – slm Sep 11 '13 at 08:33

1 Answers1

2

Be aware:
This will only be save if you did not write anything on that disk after you deleted the desired file!

If the deleted file is

/media/linuxbak/var/backup/db.tgz

then unmount the drive with

umount /media/linuxbak

change into the directory, you want the recovered file in, for example home:

cd ~

and restore it (as root) with extundelete:

apt-get install extundelete
extundelete /dev/sdb2 --restore-file '/var/backup/db.tgz'

WARNING: Extended attributes are not restored. Loading filesystem
metadata ... 508 groups loaded. Loading journal descriptors ... 30424
descriptors loaded. Restored inode 3591903 to file
RECOVERED_FILES/var/backup/db.tgz

(This worked on Ubuntu 13.04)

rubo77
  • 27,777
  • 43
  • 130
  • 199