There's also PhotoRec included in the testdisk package.

Clive

On Fri, Aug 16, 2013 at 6:25 PM, Joseph Spenner joseph85750@yahoo.comwrote:

...

From: Ahmed ahmed.daud500@gmail.com

...

To: CentOS mailing list centos@centos.org Sent: Friday, August 16, 2013 9:44 AM Subject: [CentOS] Restoring deleted files.

...

Hi,

is it possible to Restore files deleted with " rm rf " from ext4 or

ext3 filesystem by mistake.

There is something called lazarus:

http://www.fish2.com/tct/help-recovering-file

Make backups! I recommend bacula. :)

---

If life gives you lemons, keep them-- because hey.. free lemons. "♥ Sticker" fixer: http://microflush.org/stuff/stickers/heartFix.html _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos

On 08/17/2013 06:57 AM, Ljubomir Ljubojevic wrote:

On 08/16/2013 06:44 PM, Ahmed wrote:

...

Hi,

   is it possible to Restore files deleted with " rm rf " from ext4 or

ext3 filesystem by mistake.

I posted this as a Document in official CentOS Facebook group. Feel free to use it in a blog, just mention my name:

Recover files from ext3/ext4 ext4magic

How to recover deleted files: I used ext4 magic, replacement for extundelete and ext3grep: http://openfacts2.berlios.de/wikien/index.php/BerliosProject:Ext4magic

I have rpm's for CentOS 6 I downloaded from somewhere at: http://rpms.plnet.rs/plnet-centos6-i386/RPMS.plnet-downloaded/ext4magic-0.3.... http://rpms.plnet.rs/plnet-centos6-x86_64/RPMS.plnet-downloaded/ext4magic-0....

What to do:

1. First thing to do is to unmount that partition and stop using it. If

it is root partition, shutdown system and boot LiveCD/LiveDVD 6.x and work from it

2. Create a copy of your partition (to a filesystem where you have

enough free space!): dd if=/dev/DEVICE of=/BACKUPPATH/DEVICE.img

3. Create a backup of ext3/ext4 Journal:

debugfs -R "dump <8> /BACKUPPATH/journal.copy" /dev/DEVICE

4. Download and install ext4magic rpm:

CentOS i386 - for 32-bit system/LiveCD: wget http://rpms.plnet.rs/plnet-centos6-i386/RPMS.plnet-downloaded/ext4magic-0.3.... yum install ext4magic-0.3.1-1.2.i686.rpm

CentOS 6 x86_64: wget http://rpms.plnet.rs/plnet-centos6-x86_64/RPMS.plnet-downloaded/ext4magic-0.... yum install ext4magic-0.3.1-1.2.x86_64.rpm

5a. Run ext4magic on the copy/dd-image to recover all deleted files (-m switch):

ext4magic /BACKUPPATH/DEVICE.img -m -j /BACKUPPATH/journal.copy

5b. Run ext4magic on the actual partition (not recomended!):

ext4magic /dev/DEVICE -j /BACKUPPATH/journal.copy -m

5c. Recovers all files deleted the last 24 hours from directory user1/ which have the string jpg in their filename. The recovered files are stored at /LOCATION_TO_SAVE_FILES. A temporary file ./tmpfile is used to get the list of filenames to recover. :

ext4magic /BACKUPPATH/DEVICE.img -Lx -f user1 | grep "jpg" > ./tmpfile ext4magic /BACKUPPATH/DEVICE.img -i ./tmpfile -r -d /LOCATION_TO_SAVE_FILES

5d. Since the files were delete 4 days ago, I decided to R recover (everything) after 5 days ago and before 2 days ago:

ext4magic -R -a $(date -d “-5day” +%s) -b $(date -d “-2day” +%s) \ -d /LOCATION_TO_SAVE_FILES /BACKUPPATH/DEVICE.img

More help: http://source.kohlerville.com/2013/02/ext4-recover-deleted-files-undelete-us...

Thank you so much for the hardwork and contribution made by all the people to solve the problem at hand. wishing all the best to you guys. I learn a lot here. Kind Regards Ahmad Dawood