Recover Deleted Webapp Uploads on Linux with extundelete: Step‑by‑Step Guide

Background

A sudden incident deleted the uploaded files stored under /data/webapps/xxxx/upload on a Linux server, with no existing backup. The author used a data‑recovery tool to retrieve most of the lost files and documents the entire process.

Install extundelete

If the EPEL repository is enabled, install the tool directly:

yum install epel-release
yum install extundelete

When the package is not available, compile from source:

# download source tarball
wget https://example.com/extundelete.tar.gz
# extract and build
tar -xzf extundelete.tar.gz
cd extundelete
./configure
make
make install

Locate Deleted Data

Because the file path is deep, the recovery process starts by searching the filesystem’s inode tree from the root partition. By examining the inode entries for the webapps directory, the specific inode for the upload folder can be identified, and files marked as “Deleted” are highlighted as candidates for recovery.

Recover Files

With the target directory identified, run extundelete using the root partition as the base and mask the project name:

extundelete --restore-directory /data/webapps/xxxx/upload

The tool creates a RECOVERED_FILES directory in the current working folder containing the restored files. Note that some inodes may have been reallocated due to ongoing disk writes, so a few files might be unrecoverable.

Usage Options

Key options include: --version, -v : show version --help : display help --superblock : show superblock info --journal : show journal info --after dtime : files deleted after given time --before dtime : files deleted before given time Actions: --inode ino : display inode info --block blk : display block info --restore-inode ino[,ino,...] : restore specific inodes --restore-file 'path' : restore a single file --restore-files 'path' : restore all files listed under a path --restore-all : attempt to restore everything -j journal : read from a journal file -b blocknumber : use a backup superblock -B blocksize : specify block size

Precautions

After data loss, unmount the affected disk or partition. If the root partition is involved, boot into single‑user mode and remount it read‑only to prevent the system from overwriting the deleted blocks, which would make recovery impossible.

Author: wzlinux Source: http://blog.51cto.com/wzlinux/2052835