Wednesday, January 25, 2012

ext3 or ext4 partition recover deleted files Centos /Fedora

Extundelete is a utility that can recover deleted files from an ext3 or ext4 partition. The ext3 file system is the most common file system when using Linux, and ext4 is its successor. extundelete uses the information stored in the partition's journal to attempt to recover a file that has been deleted from the partition. There is no guarantee that any particular file will be able to be undeleted, so always try to have a good backup system in place, or at least put one in place after recovering your files!

Download and Install Extundelete:
Download the latest version of Extundelete - http://extundelete.sourceforge.net/

To compile and install Extundelete, you should first install the binary and development packages for e2fsprogs and e2fslibs.  You must also have a C++ compiler and a make utility to compile extundelete.
Go to terminal and type following command to install Extundelete:


#yum install -y gcc-c++ autoconf automake

#tar -xjf extundelete-0.2.0.tar.bz2
 
#cd extundelete-0.2.0
 
#./configure
 
#make

The extundelete program may be run as-is from the build directory, or you may wish to install it to a directory that is shared with other executable programs, which you may do by running the following command: make install

Using 
extundelete:
Assume you have deleted a file called /home/rajat/snap. Also assume the output of the 'mount' command shows this line (among others):

/dev/sda3 on /home type ext3 (rw)

This line shows that the /home directory is on the partition named /dev/sda3, so then run: 
umount /dev/sda3 and check that it is now unmounted by running the mount command again and seeing it is not listed.Now, with this information, run extundelete:
 

# extundelete /dev/sda3 --restore-file /home/rajat/snap/

If you have deleted the directory 'important', you can run: 
 

# extundelete /dev/sda3 --restore-directory /home/rajat/video

Or if you have deleted everything, you can run: 
 

# extundelete /dev/sda3 --restore-all
Post a Comment