Recover Accidentally Deleted Linux Files with extundelete – Step‑by‑Step Guide

Linux File Deletion Recovery Using extundelete

Accidental file deletion on Linux can be risky because there is no recycle bin; this article demonstrates a reliable method using extundelete to recover files and directories.

Preparation

Add a new disk /dev/sdb to the virtual host.

Format and mount the disk:

# mkfs.ext4 /dev/sdb
# mkdir /usr/local/dbdata/
# mount /dev/sdb /usr/local/dbdata/

Simulate Deletion

Delete a test file and a test directory:

/usr/local/dbdata/gperftools-2.4.tar.gz # file
/usr/local/dbdata/pcre-8.32 # directory

# rm -rf /usr/local/dbdata/gperftools-2.4.tar.gz /usr/local/dbdata/pcre-8.32

Protect the Partition

Remount the partition as read‑only to prevent further writes that could overwrite deleted data:

# mount -o remount,ro /dev/sdb
# mount -o remount,ro /usr/local/dbdata/

Install extundelete

Download and compile the tool (stable version 0.2.4):

# wget https://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2
# yum -y install gcc-c++ e2fsprogs.x86_64 e2fsprogs-devel.x86_64
# tar -jxvf extundelete-0.2.4.tar.bz2
# cd extundelete-0.2.4
# ./configure
# make && make install

Verify installation:

# extundelete -v

Recovery Process

List deleted inodes starting from the root inode (2):

# extundelete /dev/sdb --inode 2

The output shows the deleted file and directory:

gperftools-2.4.tar.gz 15 Deleted
pcre-8.32 655361 Deleted

Note: Do not perform recovery on the same partition that suffered the deletion to avoid inode/block overlap.

Restore the file by name:

# extundelete /dev/sdb --restore-file gperftools-2.4.tar.gz

Restore the directory by name:

# extundelete /dev/sdb --restore-directory pcre-8.32

Recovered items appear in a RECOVERED_FILES directory within the current working directory.

Conclusion

Always use rm with caution.

Partition disks according to their function.

Know at least one data‑recovery method such as extundelete.