How to Recover Accidentally Deleted Files on Linux with extundelete
When a sudden incident deletes uploaded data from the /data/webapps/.../upload directory without backups, this guide walks you through installing extundelete (via EPEL or source), locating the deleted inodes, and using extundelete commands to recover the files, while explaining why read‑only mounting is essential.
Background
A sudden incident deleted the uploaded data stored in /data/webapps/xxxx/upload with no backup, causing panic. Using a data‑recovery tool, most of the deleted files were successfully restored. The following outlines the recovery process.
Installation of extundelete
1. Install via EPEL repository
If the EPEL repository is enabled, install with the appropriate package manager command.
2. Compile from source
Finding Deleted Data
Because the data path is deep, the search proceeds step‑by‑step, starting from the root partition inode.
The weapps directory inode is displayed, followed by the project inode, and finally the deleted upload directory.
The final directory shows entries marked as Deleted , which are the target files for recovery.
Data Recovery
Recover the specified directory by setting the current partition as the root and masking the project name.
Because the disk continues to be read‑write, some inodes have been reassigned, making a few files unrecoverable; the tool reports the unrecovered count, but most data is restored.
The recovered files are placed in a newly created RECOVERED_FILES directory.
To recover all files, run:
Usage
Run extundelete --help to see options and actions.
Options include: --version, -[vV] (show version) --help (show help) --superblock (show superblock info) --journal (show journal info) --after dtime (files deleted after given time) --before dtime (files deleted before given time) Actions include: --inode ino (show inode info) --block blk (show block info) --restore-inode ino[,ino,...] (restore specific inodes to RESTORED_FILES ) --restore-file 'path' (restore a specific file to RECOVERED_FILES ) --restore-files 'path' (restore all files listed in a path) --restore-all (attempt to restore everything) -j journal (read from journal file) -b blocknumber (use backup superblock) -B blocksize (specify block size)
Post‑Deletion Procedure
After data deletion, unmount the affected disk or partition. If the root partition is affected, boot into single‑user mode and mount the root partition read‑only.
Reason: Deleting a file only clears the inode’s sector pointers; the data remains on disk. If the filesystem remains read‑write, the blocks may be reallocated and overwritten, causing permanent loss. Mounting read‑only minimizes this risk.
Author: wzlinux Source: http://blog.51cto.com/wzlinux/2052835
Signed-in readers can open the original source through BestHub's protected redirect.
This article has been distilled and summarized from source material, then republished for learning and reference. If you believe it infringes your rights, please contactand we will review it promptly.
MaGe Linux Operations
Founded in 2009, MaGe Education is a top Chinese high‑end IT training brand. Its graduates earn 12K+ RMB salaries, and the school has trained tens of thousands of students. It offers high‑pay courses in Linux cloud operations, Python full‑stack, automation, data analysis, AI, and Go high‑concurrency architecture. Thanks to quality courses and a solid reputation, it has talent partnerships with numerous internet firms.
How this landed with the community
Was this worth your time?
0 Comments
Thoughtful readers leave field notes, pushback, and hard-won operational detail here.