Once I had a big problem: I deleted the content of a whole disk by accident. Damn typo!! Don't tell me about backups, THAT was the backup. So no downtime, no immediate problem, but nearly a year of daily backups was gone. Then I understood why everybody talked about the importance of sudo, and someone arrived to the point of overriding the rm command to ask always to confirm (additionally showing the path); or even to move the files in a "trash" folder, which is periodically emptied.
Anyway, here I was, with an empty folder and no backup. I needed something to recovery deleted files in Ubuntu. I had some vague notions of OS not actually deleting files, but marking them as "writable". A little search in internet confirmed this remembrance (see Wikipedia Undelete). Not every OS or filesystem do remove in this way, bear in mind. Luckily, Ubuntu 12.04 on ext4 filesystem with journaling (see Wikipedia Journaling) can undelete files. BUT! You need the appropriate tool.
EXTUNDELETE
After trying some tools, the one I found working well is extundelete (Website: extundelete.sourceforge.net).
This tool recovers files from an UNMOUNTED partition to ANOTHER MOUNTED partition. So keep in mind, you need to UNMOUNT your partition, and to MOUNT another partition. That means, you must have a partition from which to start your OS, the partition to recover and a third partition to which recover the files.
In my case, I had a partition with the OS and a partition with the backup files. I had to create a new partition (with LVM, here is my guide: Create and extend an LVM Logical Volume in Ubuntu 12.04) to recover the files.
Now, the commands.
Before we start, UNMOUNT the partition to recover:
umount /backup-folder
If you have some problem, be sure your actual folder isn't the recovery folder. Ah, and be sure that's not your folder in ANY of you open consoles. I had 5, and in two I was in the folder to recover.
First, download the source code of extundelete. I know, usually I use apt-get but this time I built from source. It seems that apt-get package has some problems, or generally doesn't work well.
wget http://sourceforge.net/projects/extundelete/files/extundelete/0.2.4/extundelete-0.2.4.tar.bz2
Maybe you'll have to change the version number, if there's a more recent one.
Next,you have to install extundelete and its dependencies
apt-get install build-essentials
apt-get install ext2fs-dev
Then, you can extract:
tar -xjf extundelete-0.2.4.tar.bz2
Go inside the extracted folder (probably extundelete-0.2.4) and compile:
cd extundelete-0.2.4
./configure
make
make install
That's it! Now extundelete is installed.
Finally you can start to undelete files!
Writing extundelete -h you will have a list of the options you can use.
A bit of warning: the defaul behaviour of extundelete is to recover files in a directory IN THE LOCATION YOU ARE when launching the command. For example, if you are in /home/rjdio/extundelete-0.2.4 the extracted files will be in /home/rjdio/extundelete-0.2.4/RECOVERED_FILES. That for example wasn't what I wanted, so I had to set the output directory. And I discovered it when I filled my root with the recovered files. So, be careful.
Another thing.
Lastly, the documentation and the examples I found around the Internet say that you can recover single files or directory, if you know the precise name or path. I have to admit that I couldn't make this functions work. Maybe I used a wrong syntax, I dunno.
So, here it is the command I used to restore ALL the files I lost (quite, someone was somehow overwritten and so unrecoverable):
extundelete --recover-all /backup-folder -o /restore-folder
After some time (but not so much) I had almost all the files I deleted in /restore-folder/RECOVERY_FILES. The last passage was to mount back /backup-folder, copy back all the restored files, and unmount /restore-folder. Success!!
References:
- Recovering recently deleted files from an EXT3/EXT4 (with journaling) partition - A rather clear explanation with examples of how to recovery your deleted files
- extundelete.sourceforge.net - the home page of the extundelete projectLabels: bash, ubuntu