A few weeks ago I was reading a Article of Elav on backups and it fell like a glove, as I was recovering from the accidental loss of my / home.
A victim of sleep and stress, I made a mistake and my data was deleted, I went into panic and despair. After assimilating it I remembered a tool called Get out.
extundelete is an excellent tool, which allows you to recover deleted data on ext3 and ext4 partitions.
Some of its characteristics:
Ability to preserve the original name of the recovered files, it can recover partitions, directories and subdirectories, among others.
Let's go to what interests us.
When accidentally deleting a file, directory or partition, you should immediately shut down your computer or unmount the partition.
This to prevent new data from being written to the physical space of the disk, if this happens, the possibility of recovery decreases.
If possible, start from a Live CD or USB of your favorite distribution and install Extundelete.
To install on Debian and derivatives:
sudo apt-get install extundelete
Next we mount the partition where our files were located, in read mode (suppose that the sda4 partition is our home).
sudo mount -o remount,ro /dev/sda4
If we want to restore the entire partition:
sudo extundelete /dev/sda4 --restore-all
If we want to restore a specific directory (for example the folder "documents"):
sudo extundelete /dev/sda4 --restore-directory /home/tu_usuario/documentos
If we want to restore a specific file (for example the video gato.flv):
sudo extundelete /dev/sda4 --restore-file /home/tu_usuario/videos/gato.flv
If you do not know the name of the partitions that interest you, write in the console:
df -h
o
sudo fdisk -l
extundelete It has a large number of options that you can explore on its page, but with the above, you are sure to get out of trouble. I was able to recover maybe 90% - 95% of my partition.
Oh interesting, I already knew testdisk or photorec but do not extundelete, I hope I never have to use it ... I hope I have not deleted something and then regret it 😀
Thanks for the post
For nothing KZKG ^ Gaara, nice to meet 🙂
Yes, I also knew these two. But if I'm not mistaken they are used more when the partition table is broken or not?
Well, I don't need it right now but I've installed it just in case, I'll try to delete something to see how it works. I find it very interesting.
It doesn't hurt to remind you to be careful when deleting something 🙂. Regards.
Hi. Good morning, it sounds interesting but I see that it only applies to ext1 partitions. what is there for ntfs or fat .. slds.
Actually this tool is focused on ext3 and ext4. But for ntfs and others there are quite a few tools that I hope I can talk about.
hello, very interesting but only applies to ext3 and 4. what do you have for fat and ntfs? slds.
Hi, you can use PhotoRec, it supports FAT, NTFS, exFAT, ext2 / ext3 / ext4, HFS +.
What we urgently need is a recuperator with a graphical interface, new users with the console do not get along, it is a good piece of information and it is appreciated, but graphical interfaces are missing =) Kind regards
Quite true, although it is a good pretext to begin to be interested in the blessed console. Regards.
And as an animal I am trying to do it on Windows partitions with RecoverMyFiles.
Anyway, I hope they improve it to be able to be used in NTFS partitions and thus avoid paying (and / or using warez) for proprietary software.
Good post.
Good input, thank you!
Excellent, I just add that when you recover the files it saves them in a folder called RECOVERED_FILES in the current folder from where extundelete was run.
regards
Here you have a list of multiplatform and free tools for recovering deleted files. It also shows the 5 questions to ask yourself before trying to recover files so as not to waste time http://cursohacker.es/recuperar-archivos-borrados-programas
Greetings.
Very useful article. 🙂
Do you know if there is something similar for BTRFS?
Greetings.
Hello:
To recover deleted photos, which is the best?
Thank you
This utility is great, it worked 95%. Better than others there are, you just have to add the –output-dir option to the command so that they are restored to another hard disk and not overwrite files that were not recovered, so we can pass another utility to check the disk. Thanks for sharing.
Thank you. Very useful, I almost completely recovered the directory «Desktop» (which I surely accidentally deleted because it just appeared empty) from my / home folder, I used KaliLinux
I have a problem, apparently it cannot retrieve a file or directory that has a space in its entire address, for example, Home / user / music / DISK 1, I don't know ... it throws an error for me.
Hello, thanks for the information, very useful especially because, if one is going to retrieve information, it is more for urgency. One question, in the process of recovering the entire partition, says that first you have to unmount the partition, for example, if it is in the / home folder (Debian-Ubuntu) that you have it as a partition, how could you unmount and continue with the process, would you play via root? Is it possible that when restarting some information it will be lost if it is expected to recover at the same time as it is erased?