Before starting the experiment, I have created a new empty directory /data, mounted a new hard disk in this directory, and formatted the hard disk partition as ext4 format, so when I operate /datathe files and folders in the directory, the actual The above is to perform data read and write operations on the newly mounted hard disk. First, prepare a file for the experiment through the following commands, create a new file /data/delfile1.txtand write data, create a new directory /data/deldir, and create a new file in the directory /data/deldir/delfile2.txt.

echo "ext4 delete test" > /data/delfile1.txt;
mkdir /data/deldir;
echo "ext4 delete test2" > /data/deldir/delfile2.txt;

After completing the above operations, /datathe file path tree in the directory is as follows:

/data
├── deldir
│   └── delfile2.txt
├── delfile1.txt

We use extundelete, an advanced installation, to recover files deleted by mistake in ext4 format.

yum install extundelete -y;

After the installation is complete, let's officially conduct the experiment, first delete the files and folders under the directory rm -fr /data/delfile1.txt /data/deldir. The first time after the file is deleted by mistake, we should unmount the hard disk from the operating system: The umount /dev/sdb1reason for this is to prevent the operating system process from continuously writing data to the disk, resulting in overwriting of data blocks. After a data block is overwritten, the files on the data block cannot be recovered.

# extundelete /dev/sdb1 --inode 2
File name                                       | Inode number | Deleted status
.                                                 2
..                                                2
lost+found                                        11
delfile1.txt                                      12             Deleted
deldir                                            262145         Deleted

Using the above command, we can view the files (node number=12) and folders (node number=262145) that were deleted by mistake. Remarks: The inode value of the partition root directory of the ext4 file system is 2, and the inode value of the root directory of the xfs partition is 64.

extundelete /dev/sdb1 --restore-file delfile1.txt #Restore file
extundelete /dev/sdb1 --restore-directory deldir #Restore directory
extundelete /dev/sdb1 --restore-inode 12 #Restore according to the innode number
extundelete /dev/sdb1 --restore-all #Restore all

After the above recovery operation, a new RECOVERED_FILES will be created under the folder where the command is executed. Check if there are any files or folders you accidentally deleted under the RECOVERED_FILES folder? There is a certain probability of failure in the operation of file accidental deletion and recovery .