How to recover deleted files in Linux

Linux recover deleted files, we can use the debugfs command.

In the process of using the Linux system, occasionally some useful files are accidentally deleted, so how to undelete and recover these files?

Today, we introduce the use of debugfs command to recover deleted files.

Linux deleted file recovery steps:

1 . Run the following command to enter debugfs mode.

➜  ~ sudo debugfs -w /dev/sda1

Where sda1 is the partition where each person exists, which may be different.

2 . Run lsdel to list all recently deleted files.

debugfs:  lsdel

The result is chronologically arranged from old to new.

The output format is similar:

Inode Owner Mode Size Blocks Time deleted
8934222 14456 100664 592 1/ 1 Wed Aug 26 11:49:48 2019
...

If there are too many results, you can execute the following command to output the results to a local file.

➜  ~ echo lsdel | debugfs /dev/sda1 > lsdel.out

3 . You can find the deleted file from the listed deletion results, or from the saved result file, which can be confirmed according to the deletion time and the file owner.

After finding the deleted file, record the first number, which is the inode number.

4 . In debugfs mode, execute dump <123456> /tmp/123456.bak to recover the deleted files, where 123456 is the inode number of the deleted files.

5. Confirm recovery file.