How to Recover Accidentally Deleted Linux Upload Files with extundelete

Background

A sudden incident deleted the data stored in /data/webapps/xxxx/upload with no backup available, causing urgent need for recovery. Using the extundelete tool, most of the deleted files were successfully recovered.

Install extundelete

1. Install via EPEL repository

If the EPEL repository is enabled, install extundelete directly:

yum install extundelete

2. Compile from source

Alternatively, download the source code and compile:

git clone https://github.com/extundelete/extundelete.git

cd extundelete && make && make install

Locate Deleted Data

Because the data path is deep, locate the deleted files step by step, starting from the root partition inode.

We see the webapps directory inode, then the project inode, and finally the upload directory where the deleted files reside.

The final directory shows entries marked as Deleted , which are the target files for recovery.

Data Recovery

Recover the specified directory using the current partition as the root and mask the project name:

extundelete --restore-directory /data/webapps/xxxx/upload

Because the disk is still being read‑written, some inodes have been reallocated, so a few files cannot be recovered. The tool reports the number of unrecoverable files, but most data is restored.

The recovered files are placed in a directory named RECOVERED_FILES created in the current working directory.

To recover all files, run:

extundelete --restore-all

Usage

Run extundelete --help to see available options:

Options include: --version, -v: show version --help: show help --superblock: show superblock info --journal: show journal info --after dtime: files deleted after given time --before dtime: files deleted before given time Actions include: --inode ino: show info for inode --block blk: show info for block --restore-inode ino[,ino,...]: restore files by inode --restore-file 'path': restore a specific file --restore-files 'path': restore listed files --restore-all: attempt to restore everything -j journal: read journal file -b blocknumber: use backup superblock -B blocksize: specify block size

Important Precautions

After data deletion, unmount the affected disk or partition. If the root partition is affected, boot into single‑user mode and mount the root partition as read‑only.

Reason: Deleting a file only clears the inode’s block pointers; the data remains on disk until overwritten. Mounting read‑only minimizes the risk of overwriting the deleted blocks, increasing the chance of successful recovery.