Recover Accidentally Deleted Linux Files with extundelete – Step‑by‑Step Guide

Linux File Deletion Recovery Using extundelete

Accidental file deletion on Linux can be risky because there is no recycle bin; this article demonstrates a reliable method using

extundelete

to recover files and directories.

Preparation

Add a new disk

/dev/sdb

to the virtual host.

Format and mount the disk:

<code># mkfs.ext4 /dev/sdb
# mkdir /usr/local/dbdata/
# mount /dev/sdb /usr/local/dbdata/</code>

Simulate Deletion

Delete a test file and a test directory:

<code>/usr/local/dbdata/gperftools-2.4.tar.gz # file
/usr/local/dbdata/pcre-8.32 # directory</code>

<code># rm -rf /usr/local/dbdata/gperftools-2.4.tar.gz /usr/local/dbdata/pcre-8.32</code>

Protect the Partition

Remount the partition as read‑only to prevent further writes that could overwrite deleted data:

<code># mount -o remount,ro /dev/sdb
# mount -o remount,ro /usr/local/dbdata/</code>

Install extundelete

Download and compile the tool (stable version 0.2.4):

<code># wget https://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2
# yum -y install gcc-c++ e2fsprogs.x86_64 e2fsprogs-devel.x86_64
# tar -jxvf extundelete-0.2.4.tar.bz2
# cd extundelete-0.2.4
# ./configure
# make && make install</code>

Verify installation:

<code># extundelete -v</code>

Recovery Process

List deleted inodes starting from the root inode (2):

<code># extundelete /dev/sdb --inode 2</code>

The output shows the deleted file and directory:

<code>gperftools-2.4.tar.gz 15 Deleted
pcre-8.32 655361 Deleted</code>

Note: Do not perform recovery on the same partition that suffered the deletion to avoid inode/block overlap.

Restore the file by name:

<code># extundelete /dev/sdb --restore-file gperftools-2.4.tar.gz</code>

Restore the directory by name:

<code># extundelete /dev/sdb --restore-directory pcre-8.32</code>

Recovered items appear in a

RECOVERED_FILES

directory within the current working directory.

Conclusion

Always use

rm

with caution.

Partition disks according to their function.

Know at least one data‑recovery method such as

extundelete

.