As we all know… if you accidentally deleted a file… you better have a working backup.

If not: Try to do as less write access as possible to the disk – turn off PC and boot from Live-CD-USB-Stick such as KNOPPIX.

UNMOUNT / UNPLUG HARDDISK / PARTITION IMMEDIATELY 😀 and boot from knoppix live-CD

extundelete.man.txt

let us take a picture of Mr Stallmann for a test delete and restore drive.

i want to demonstrate that extundelete actually works well with ext3 but miserable with ext4:

hostnamectl; # testing was done with
   Static hostname: debian9
         Icon name: computer-vm
           Chassis: vm
        Machine ID: 532eabca552b4075a8679094397c8dba
           Boot ID: c51ea5627e7a4e9dae150aaeea9e29a2
    Virtualization: microsoft
  Operating System: Debian GNU/Linux 9 (stretch)
            Kernel: Linux 4.12.0cuztom
      Architecture: x86-64

apt-get install extundelete;

lsblk -fs; # as you can see there are thwo partitions sdb5 with ext4 and sdb6 with ext3
NAME  FSTYPE LABEL UUID                                 MOUNTPOINT
sdb3
└─sdb
sdb5  ext4   ext4  e8926fbe-b937-4576-b5b8-70a115fce795
└─sdb
sdb6  ext3   ext3  5f06baec-02be-4ed8-8e85-a7eb7fc87b6e
└─sdb

mkdir /mnt/ext4;
mkdir /mnt/ext3;

mount /dev/sdb5 /mnt/ext4;
mount /dev/sdb6 /mnt/ext3;

# let's create some sample content
echo "this is a very important file with important content of which no backup exists" > /mnt/ext3/very_important_file.txt

echo "this is a very important file with important content of which no backup exists" > /mnt/ext4/very_important_file.txt

wget -P /mnt/ext4 http://dwaves.de/wp-content/uploads/2017/06/Richard-Stallman.jpg;
wget -P /mnt/ext3 http://dwaves.de/wp-content/uploads/2017/06/Richard-Stallman.jpg;

# checksum those files
md5sum /mnt/ext4/*
d41d8cd98f00b204e9800998ecf8427e  /mnt/ext4/fschk
md5sum: /mnt/ext4/lost+found: Is a directory
fab9d3e592942c468365a97c6e620f35  /mnt/ext4/Richard-Stallman.jpg
ecb25c87f02bb0874246a166432bd3c4  /mnt/ext4/very_important_file.txt

md5sum /mnt/ext3/*
fab9d3e592942c468365a97c6e620f35  /mnt/ext3/Richard-Stallman.jpg
ecb25c87f02bb0874246a166432bd3c4  /mnt/ext3/very_important_file.txt

# now delete
rm -rf /mnt/ext3/*
rm -rf /mnt/ext4/*

# now unmount
umount /mnt/ext3 /mnt/ext4

# create directory where to restore the files
mkdir /mnt/restored/;
cd /mnt/restored/;

# let's start with ext4 partition
extundelete --restore-all /dev/sdb5
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 80 groups loaded.
Loading journal descriptors ... 26 descriptors loaded.
Searching for recoverable inodes in directory / ...
0 recoverable inodes found.
Looking through the directory structure for deleted files ...
0 recoverable inodes still lost.
No files were undeleted.

# let's give ext3 a try
extundelete --restore-all /dev/sdb6
NOTICE: Extended attributes are not restored.
Loading filesystem metadata ... 80 groups loaded.
Loading journal descriptors ... 40 descriptors loaded.
Searching for recoverable inodes in directory / ...
3 recoverable inodes found.
Looking through the directory structure for deleted files ...
0 recoverable inodes still lost.

root@debian9:/mnt/restored# ll RECOVERED_FILES/
total 68K
drwxr-xr-x 2 root root 4.0K Jul  6 15:41 .
drwxr-xr-x 3 root root 4.0K Jul  6 15:26 ..
-rw-r--r-- 1 root root   45 Jul  6 15:41 important.txt
-rw-r--r-- 1 root root  50K Jul  6 15:41 Richard-Stallman.jpg
-rw-r--r-- 1 root root   79 Jul  6 15:41 very_important_file.txt

 md5sum ./RECOVERED_FILES/*
244b5d8e29526a0f9cff08174ac4433b  ./RECOVERED_FILES/important.txt
fab9d3e592942c468365a97c6e620f35  ./RECOVERED_FILES/Richard-Stallman.jpg
ecb25c87f02bb0874246a166432bd3c4  ./RECOVERED_FILES/very_important_file.txt

this alone let’s me say – STAY AWAY FROM EXT4! 😀

what is all the speed in the world… if you can not recover your lost files?

admin