How to Recover Accidentally Deleted Linux Files with extundelete

Linux File Deletion Recovery Using extundelete

Accidental deletion of files on a Linux system can be risky because there is no recycle bin; recovery requires careful steps. This article demonstrates a reliable method using the extundelete tool.

Preparation

Add a new disk to the virtual host (e.g., /dev/sdb)

Format and mount the disk

# mkfs.ext4 /dev/sdb
# mkdir /usr/local/dbdata/
# mount /dev/sdb /usr/local/dbdata/

Delete test files

/usr/local/dbdata/gperftools-2.4.tar.gz # file
/usr/local/dbdata/pcre-8.32 # directory

Execute the accidental removal:

# rm -rf /usr/local/dbdata/gperftools-2.4.tar.gz /usr/local/dbdata/pcre-8.32

Remount the partition as read‑only If the files are confirmed deleted and no backup exists, immediately protect the partition to prevent overwriting:

# mount -o remount,ro /dev/sdb
# mount -o remount,ro /usr/local/dbdata/

Install extundelete Download and extract the tool:

# wget https://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2

Install dependencies and compile:

# yum -y install gcc-c++ e2fsprogs.x86_64 e2fsprogs-devel.x86_64
# tar -jxvf extundelete-0.2.4.tar.bz2
# cd extundelete-0.2.4
# ./configure
# make && make install

Verify installation: # extundelete -v Recover deleted files First, list deleted inodes (starting from the root inode 2):

# extundelete /dev/sdb --inode 2

Note: Perform recovery on a different partition to avoid inode/block overlap.

Restore the specific file:

# extundelete /dev/sdb --restore-file gperftools-2.4.tar.gz

Restore the deleted directory:

# extundelete /dev/sdb --restore-directory pcre-8.32

Recovered items appear in a RECOVERED_FILES directory within the current working directory.

Summary

Use rm with caution.

Partition disks according to their function.

Know at least one method for data recovery.