Undelete files on Linux

To continue my series of "Oops i did it again" I would like to explain few methods that allows you to undelete files on Linux. One of the fastest and easiest method I found so far is with the help of Extundelete utility that works only for ext3 and ext4 partitions. If you delete by mistake a file like ~/Documents/src/myfile.txt that resides on /dev/sdc2 partition then all you have to do is just to run a command like the one below:

extundelete --restore-file ~/Documents/src/myfile.txt /dev/sdc2

This will create a RECOVERED_FILES directory where all the recovered files are stored using the whole restore path (i.e. <root>.../Documents/src/myfile.txt). Another simple solution is DebugFS utility that allows you to debug a file system, including recovering the deleted inodes/files. If you want to recover the same file like the one mentioned earlier you could do like this:

debugfs /dev/sdc2
debugfs: ls
debugfs: cd /path-to-deleted-file
debugfs: lsdel
debugfs: dump <123456> /tmp/recovered.txt
debugfs: quit

 What this does, step by step, is:

• connect to the device /dev/sdc2

• list the current directory (probably the root of /dev/sdc2)

• change the current directory within /dev/sdc2 to my path-to-deleted-file

• list deleted files; it will present me a list of the deleted inodes

• once I found the inode I am interested I will dump its content to a file on the local mounted partition

• quit the utility

Two other programs that you can use are Testdisk and PhotoRec. You can read my experience with these here. Consider also using the e2undel utility.