0

This question already has an answer here:

Usually, the best way to recover a deleted file is to have backups and that, if the backup failed, you should immediately remount the drive read-only. (See this thread: How to recover a file just deleted )

But in some occasions, if the deleted file wasn't that important, it just would save some time to just "undelete" it.

Is there a simple way I could try on bash for the case that the deleted file on an ext4 filesystem was the only file on the disk, especially, if the disk is not used otherwise?

marked as duplicate by slm, Anthon, jasonwryan, Mat, rahmu Sep 11 '13 at 11:46

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Possibly related: unix.stackexchange.com/questions/14952/… – slm Sep 11 '13 at 6:56
  • none of those possible duplicates show a simple solution I am looking for. Maybe it would be easy with extundelete? – rubo77 Sep 11 '13 at 8:12
  • That was kind of the conclusion in those Q&A's and others if you search the site. It isn't easy to do this. There are other tools I've seen such as undelete floating around the web. They all work some times. But you still needed to understand how the different Unix filesystems work, which defeats the point of what you're asking. – slm Sep 11 '13 at 8:17
  • I was just asking on an ext4 filesystem. I solved it now with extundelete. see my answer below – rubo77 Sep 11 '13 at 8:20
  • I figured you were ext4 but you didn't specify that originally. I believe it's reaching into the journal to do this. Some filesystems don't have a journal so it's trickier. exundelete was one of the tools I was thinking of, glad you solved your issue, good write-up! – slm Sep 11 '13 at 8:22
2

Be aware:
This will only be save if you did not write anything on that disk after you deleted the desired file!

If the deleted file is

/media/linuxbak/var/backup/db.tgz

then unmount the drive with

umount /media/linuxbak

change into the directory, you want the recovered file in, for example home:

cd ~

and restore it (as root) with extundelete:

apt-get install extundelete
extundelete /dev/sdb2 --restore-file '/var/backup/db.tgz'

WARNING: Extended attributes are not restored. Loading filesystem
metadata ... 508 groups loaded. Loading journal descriptors ... 30424
descriptors loaded. Restored inode 3591903 to file
RECOVERED_FILES/var/backup/db.tgz

(This worked on Ubuntu 13.04)

Not the answer you're looking for? Browse other questions tagged or ask your own question.