Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save FangliangBai/a1c708f6029a808dffc8b3a204627885 to your computer and use it in GitHub Desktop.
Save FangliangBai/a1c708f6029a808dffc8b3a204627885 to your computer and use it in GitHub Desktop.
Ubuntu 16.04 recover files which were deleted by rm command
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% - This snip is for ext4 partition.
% - Do this operation immediately after you deleting the files.
% - There is a possibility that some files are not recoverable.
% - Reference:
% https://blog.csdn.net/q1302182594/article/details/47315177
% https://blog.csdn.net/fjb2080/article/details/5604103
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Install extundelete.
$ sudo apt-get install extundelete
% Check the name of the device where your files were.
$ df -h (or use Disks app)
% Recover files (assuming /dev/sda is the target device you want to recover).
$ sudo extundelete /dev/sda --restore-all
% Find the recovered files: The recovered files are in the folder `RECOVERED_FILES` under the path where you do the recovery.
% If you got following message:
The partition should be unmounted to undelete any files without further data loss.
If the partition is not currently mounted, this message indicates
it was improperly unmounted, and you should run fsck before continuing.
If you decide to continue, extundelete may overwrite some of the deleted
files and make recovering those files impossible. You should unmount the
file system and check it with fsck before using extundelete.
Would you like to continue? (y/n)
% then umount that device first and redo the recovery.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment