0

Usually, the best way to recover a deleted file is to have backups and that, if the backup failed, you should immediately remount the drive read-only. (See this thread: How to recover a file just deleted )

But in some occasions, if the deleted file wasn't that important, it just would save some time to just "undelete" it.

Is there a simple way I could try on bash for the case that the deleted file on an ext4 filesystem was the only file on the disk, especially, if the disk is not used otherwise?

Improve this question
8
  • Possibly related: unix.stackexchange.com/questions/14952/… Commented Sep 11, 2013 at 6:56
  • none of those possible duplicates show a simple solution I am looking for. Maybe it would be easy with extundelete? Commented Sep 11, 2013 at 8:12
  • That was kind of the conclusion in those Q&A's and others if you search the site. It isn't easy to do this. There are other tools I've seen such as undelete floating around the web. They all work some times. But you still needed to understand how the different Unix filesystems work, which defeats the point of what you're asking. Commented Sep 11, 2013 at 8:17
  • I was just asking on an ext4 filesystem. I solved it now with extundelete. see my answer below Commented Sep 11, 2013 at 8:20
  • I figured you were ext4 but you didn't specify that originally. I believe it's reaching into the journal to do this. Some filesystems don't have a journal so it's trickier. exundelete was one of the tools I was thinking of, glad you solved your issue, good write-up! Commented Sep 11, 2013 at 8:22

1 Answer 1

Reset to default
2

Be aware:
This will only be save if you did not write anything on that disk after you deleted the desired file!

If the deleted file is

/media/linuxbak/var/backup/db.tgz

then unmount the drive with

umount /media/linuxbak

change into the directory, you want the recovered file in, for example home:

cd ~

and restore it (as root) with extundelete:

apt-get install extundelete
extundelete /dev/sdb2 --restore-file '/var/backup/db.tgz'

WARNING: Extended attributes are not restored. Loading filesystem
metadata ... 508 groups loaded. Loading journal descriptors ... 30424
descriptors loaded. Restored inode 3591903 to file
RECOVERED_FILES/var/backup/db.tgz

(This worked on Ubuntu 13.04)

Improve this answer
1
  • Remember to use sudo with umount and extundelete commands Commented Dec 31, 2014 at 18:54

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.