I still clearly remembered once I mistyped
rm and I deleted my assignment which takes me an entire weekend to write. That time, I wanted to execute the command:
mv xxx.c src/xxx.c (I wanted to put all source code in
src folder) but what I really typed in the terminal was:
rm xxx.c src/xxx.c. Right after I pressed the enter key, I realized that was a disaster. But it was already too late (though
src/xxx.c doesn’t exist,
xxx.c will be deleted anyway if that command executes). Fortunately, I recovered it finally but it took much more time than that of recovering a file in Microsoft Windows.
When you notice you mistakenly deleted a file, the first step to take is always DISABLING WRITE to that disk IMMEDIATELY.
Delete command won’t erase your data from your disk but WRITE COMMAND WILL. Here, I use my system as example. I use ArchLinux as OS and ext4 as file system. All my personal data is stored under
/home/jeffery and I mount
/home. But home directory for my root user is
/root. So I first use root user to make the disk read only. (For next few steps, I use user
root. Since home directories of other users are in
/home and that’s read-only now)
su root #password fuser -km /home #kill all things currently using /home umount /home mount –t ext4 –o ro /dev/sdb4 /home #ro = read only
Then, I use a tool called undelete to help me.
wget http://downloads.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2?r=&ts=1431286176&use_mirror=tcpdiag tar jxvf extundelete-0.2.4.tar.bz2 cd extundelte-0.2.4 ./configure make make install
The next step is using undelete to recover the file. Now, assume we mistakenly deleted file
First we need to have the id of the parent folder. Then, we should unmount that disk and restore the file.
ls -id /home/jeffery/test #result = 2892570 umount /dev/sdb4 extundelete /dev/sdb4 --inode 2892570 # find inode for a.temp is 2892625 extundelete /dev/sdb4 --restore-inode 2892625
The result for
extundelete /dev/sdb4 --inode 2892570 is in the following figure.
Finally, we can find the restored file in
/RECOVERED_FILES. File name for the restored file is
file.2892625. It’s the exact file I deleted just now.
undelete can also help restore the whole directory you delete or simply restore everything.