Recover Deleted Linux Files: From Open Descriptors to Extundelete

Linux does not have a visible recycle bin like Windows, so recovering deleted files requires different techniques. The recovery process can be divided into two cases: the file is still referenced by a running process, or the process has terminated and the file must be restored with external tools.

1. File deleted while the process is still running

When a process keeps a file descriptor open, the file’s inode remains in use even after the file is removed, which can cause disk space not to be released. Example:

root@21yunwei_backup ~# echo "hello  py" > testdelete.py
root@21yunwei_backup ~# cat >> testdelete.py
hello delete
root@21yunwei_backup ~# cat testdelete.py
hello  py
hello delete
root@21yunwei_backup ~# rm -f ./testdelete.py

After removal, the file no longer appears in the directory listing. Use lsof to check whether the file is still open:

root@21yunwei_backup ~# lsof | grep deleted
mysqld   1512   mysql   5u   REG   252,3631 /tmp/ibzW3Lot (deleted)
cat      20464  root    1w   REG   252,3   /root/testdelete.py (deleted)

Since the process still holds the file, it can be recovered by copying the file descriptor from /proc/<pid>/fd/ to a regular file:

cp /proc/20464/fd/1 /path/to/recovered_testdelete.py

Verification shows the file content has been restored.

2. File deleted after the process has exited (tool‑based recovery)

If no process holds the file, lsof will not list it. In this case a third‑party tool such as extundelete is needed.

Steps:

Stop all activity on the affected partition to avoid inode overwriting (unmount the device or disconnect the network).

(Optional) Create a raw backup of the partition with dd to protect data.

Install extundelete:

wget http://nchc.dl.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2
tar jxvf extundelete-0.2.4.tar.bz2
cd extundelete-0.2.4
./configure
make
make install

Use extundelete to restore files:

Restore a single file: extundelete /dev/vdb1 --restore-file passwd Restore a directory:

extundelete /dev/vdb1 --restore-directory deletetest

Restore all recoverable files: extundelete /dev/vdb1 --restore-all Restore by inode number: extundelete /dev/vdb1 --restore-inode 14 Recovered files are placed in a RECOVERED_FILES directory. Note that when restoring by inode the file name may differ from the original; rename as needed.

Original article: http://www.21yunwei.com/archives/6030 (author: 21运维)