How to Recover Accidentally Deleted Linux Files with extundelete

Linux File Deletion Recovery Using extundelete

Accidental deletion of files on a Linux system can be risky because there is no recycle bin; recovery requires careful steps. This article demonstrates a reliable method using the extundelete tool.

Preparation

Add a new disk to the virtual host (e.g., /dev/sdb)

Format and mount the disk

<code># mkfs.ext4 /dev/sdb
# mkdir /usr/local/dbdata/
# mount /dev/sdb /usr/local/dbdata/</code>

Delete test files

<code>/usr/local/dbdata/gperftools-2.4.tar.gz # file
/usr/local/dbdata/pcre-8.32 # directory</code>

Execute the accidental removal:

<code># rm -rf /usr/local/dbdata/gperftools-2.4.tar.gz /usr/local/dbdata/pcre-8.32</code>

Remount the partition as read‑only If the files are confirmed deleted and no backup exists, immediately protect the partition to prevent overwriting:

<code># mount -o remount,ro /dev/sdb
# mount -o remount,ro /usr/local/dbdata/</code>

Install extundelete Download and extract the tool:

<code># wget https://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2</code>

Install dependencies and compile:

<code># yum -y install gcc-c++ e2fsprogs.x86_64 e2fsprogs-devel.x86_64
# tar -jxvf extundelete-0.2.4.tar.bz2
# cd extundelete-0.2.4
# ./configure
# make && make install</code>

Verify installation:

<code># extundelete -v</code>

Recover deleted files First, list deleted inodes (starting from the root inode 2):

<code># extundelete /dev/sdb --inode 2</code>

Note: Perform recovery on a different partition to avoid inode/block overlap.

Restore the specific file:

<code># extundelete /dev/sdb --restore-file gperftools-2.4.tar.gz</code>

Restore the deleted directory:

<code># extundelete /dev/sdb --restore-directory pcre-8.32</code>

Recovered items appear in a RECOVERED_FILES directory within the current working directory.

Summary

Use

rm

with caution.

Partition disks according to their function.

Know at least one method for data recovery.