# create a file and assign to a loop block device
# create a test file
dd if=/dev/zero of=test.img bs=1M count=100
# make the file to be a block device
losetup /dev/loop0 ./test.img
# create ext4 filesystem
mkfs.ext4 /dev/loop0
mount /dev/loop0 /mnt
# copy files to filesystem
cp /bin/* /mnt
sync
# record the delete time
t=$(date "+%s") # the time when file deleted
# delete file
rm -f /mnt/l*
rm -f /mnt/s*
# umount, prevent future write to overwrite the file content what been deleted
umount /mnt
# restore
extundelete /dev/loop0 --restore-all --after $t # restore all files after $t
# see restored file
ls RECOVERED_FILES # all files restored here
Last active
August 22, 2016 03:19
-
-
Save fangdingjun/91aa15a8c90ee46d55c3af4c096a47e6 to your computer and use it in GitHub Desktop.
example for restore deleted file on ext3/ext4
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment