1 Introduction
When using the linux operating system, if you use commands such as rm files accidentally deleted, do not worry, do not create a new file in the directory, you can use two methods described in this article to recover deleted files. Man of few words said, can be restored using debugfs and extundelete two ways.
Suppose you have a file test.txt from accidental deletion, and now these two methods were used to recover files.
2. Using debugfs file recovery
This method may not be applicable on centos, it is recommended to use the second method.
First check the partition delete files, assuming / dev / sda1
df -Th
Then open the partition debugfs enter and view the deleted files
debugfs /dev/sda1
ls -d /root/Desktop
To delete a note in front of the file test.txt Index: <9200411>
to view the details of the index
logdump -i <9200411>
The recording block = 36700424, offset = 3328
q to quit debugfs.
Enter the recovery command
dd if=/dev/sda5 of=/root/Desktop/test.txt bs=3328 count=1 skip=36700424
Where bs = offset, skip = block, so the file has been restored.
3.extundelete file recovery
Debugfs method and the same, you can find deleted files partition index.
Use one of the following commands to restore
extundelete /dev/sda1 --restore-directory dirname #恢复/dev/sda1分区的dirname文件夹
extundelete /dev/sda1 --restore-files filename #恢复/dev/sda1分区的filename文件，该文件存在
extundelete /dev/sda1 --restore-file filename #恢复/dev/sda1分区的filename文件，该文件已删除
extundelete /dev/sda1 --restore-inode inode1,inode2 #恢复/dev/sda1分区的索引为inode1和inode2的文件
File recovery in RECOVERED_FILES file in the current directory folder.
Such as the use -restore-directory restore Desktop folder
into the folder RECOVERED_FILES will find text.txt has been restored as well.
If -restore-inode, the recovered file named file.inode
