A file in linux-ext4 format is deleted by mistake, how to restore it?

Before starting the experiment, I have created a new empty directory /data , and mounted a new hard disk in this directory, and formatted the hard disk partition as ext4 format, so when I operate /data When the files and folders in the directory are actually read and written data for the newly mounted hard disk. First prepare the experimental files through the following commands, create a new file /data/delfile1.txt and write the data, create a new directory /data/deldir , and create a new file in the directory /data/deldir/delfile2.txt .

 echo "ext4 delete test" > /data/delfile1.txt;
mkdir /data/deldir;
echo "ext4 delete test2" > /data/deldir/delfile2.txt;

After completing the above operations, the file path tree in the /data directory is as follows:

 /data
├── deldir
│   └── delfile2.txt
├── delfile1.txt

We use extundelete, an advanced installation, to recover files deleted by mistake in ext4 format.

 yum install extundelete -y;

After the installation is complete, let's officially carry out the experiment. First, delete the files and folders under the directory rm -fr /data/delfile1.txt /data/deldir . The first time after the file is deleted by mistake, we should umount the hard disk from the operating system: umount /dev/sdb1 , the reason for this is to prevent the operating system process from continuously writing data to the disk, resulting in overwriting of data blocks . After a data block is overwritten, the files on the data block cannot be recovered.

 # extundelete /dev/sdb1 --inode 2
File name                                       | Inode number | Deleted status
.                                                 2
..                                                2
lost+found                                        11
delfile1.txt                                      12             Deleted
deldir                                            262145         Deleted

Using the above command, we can view the files (node number=12) and folders (node number=262145) that were deleted by mistake. Remarks: The inode value of the partition root directory of the ext4 file system is 2, and the inode value of the root directory of the xfs partition is 64.

 extundelete /dev/sdb1  --restore-file delfile1.txt  #恢复文件
extundelete /dev/sdb1  --restore-directory deldir  #恢复目录
extundelete /dev/sdb1  --restore-inode 12 #按照innode编号进行恢复
extundelete /dev/sdb1  --restore-all #全部恢复

After the above recovery operation, a new RECOVERED_FILES will be created under the folder where the command is executed. Check if there are any files or folders that you accidentally deleted under the RECOVERED_FILES folder? There is a certain probability of failure in the operation of file accidental deletion and recovery .