As we all know… if you accidentally deleted a file… you better have a working backup.
If not: Try to do as less write access as possible to the disk – turn off PC and boot from Live-CD-USB-Stick such as KNOPPIX.
UNMOUNT / UNPLUG HARDDISK / PARTITION IMMEDIATELY 😀 and boot from knoppix live-CD
let us take a picture of Mr Stallmann for a test delete and restore drive.
i want to demonstrate that extundelete actually works well with ext3 but miserable with ext4:
hostnamectl; # testing was done with Static hostname: debian9 Icon name: computer-vm Chassis: vm Machine ID: 532eabca552b4075a8679094397c8dba Boot ID: c51ea5627e7a4e9dae150aaeea9e29a2 Virtualization: microsoft Operating System: Debian GNU/Linux 9 (stretch) Kernel: Linux 4.12.0cuztom Architecture: x86-64 apt-get install extundelete; lsblk -fs; # as you can see there are thwo partitions sdb5 with ext4 and sdb6 with ext3 NAME FSTYPE LABEL UUID MOUNTPOINT sdb3 └─sdb sdb5 ext4 ext4 e8926fbe-b937-4576-b5b8-70a115fce795 └─sdb sdb6 ext3 ext3 5f06baec-02be-4ed8-8e85-a7eb7fc87b6e └─sdb mkdir /mnt/ext4; mkdir /mnt/ext3; mount /dev/sdb5 /mnt/ext4; mount /dev/sdb6 /mnt/ext3; # let's create some sample content echo "this is a very important file with important content of which no backup exists" > /mnt/ext3/very_important_file.txt echo "this is a very important file with important content of which no backup exists" > /mnt/ext4/very_important_file.txt wget -P /mnt/ext4 http://dwaves.de/wp-content/uploads/2017/06/Richard-Stallman.jpg; wget -P /mnt/ext3 http://dwaves.de/wp-content/uploads/2017/06/Richard-Stallman.jpg; # checksum those files md5sum /mnt/ext4/* d41d8cd98f00b204e9800998ecf8427e /mnt/ext4/fschk md5sum: /mnt/ext4/lost+found: Is a directory fab9d3e592942c468365a97c6e620f35 /mnt/ext4/Richard-Stallman.jpg ecb25c87f02bb0874246a166432bd3c4 /mnt/ext4/very_important_file.txt md5sum /mnt/ext3/* fab9d3e592942c468365a97c6e620f35 /mnt/ext3/Richard-Stallman.jpg ecb25c87f02bb0874246a166432bd3c4 /mnt/ext3/very_important_file.txt # now delete rm -rf /mnt/ext3/* rm -rf /mnt/ext4/* # now unmount umount /mnt/ext3 /mnt/ext4 # create directory where to restore the files mkdir /mnt/restored/; cd /mnt/restored/; # let's start with ext4 partition extundelete --restore-all /dev/sdb5 NOTICE: Extended attributes are not restored. Loading filesystem metadata ... 80 groups loaded. Loading journal descriptors ... 26 descriptors loaded. Searching for recoverable inodes in directory / ... 0 recoverable inodes found. Looking through the directory structure for deleted files ... 0 recoverable inodes still lost. No files were undeleted. # let's give ext3 a try extundelete --restore-all /dev/sdb6 NOTICE: Extended attributes are not restored. Loading filesystem metadata ... 80 groups loaded. Loading journal descriptors ... 40 descriptors loaded. Searching for recoverable inodes in directory / ... 3 recoverable inodes found. Looking through the directory structure for deleted files ... 0 recoverable inodes still lost. root@debian9:/mnt/restored# ll RECOVERED_FILES/ total 68K drwxr-xr-x 2 root root 4.0K Jul 6 15:41 . drwxr-xr-x 3 root root 4.0K Jul 6 15:26 .. -rw-r--r-- 1 root root 45 Jul 6 15:41 important.txt -rw-r--r-- 1 root root 50K Jul 6 15:41 Richard-Stallman.jpg -rw-r--r-- 1 root root 79 Jul 6 15:41 very_important_file.txt md5sum ./RECOVERED_FILES/* 244b5d8e29526a0f9cff08174ac4433b ./RECOVERED_FILES/important.txt fab9d3e592942c468365a97c6e620f35 ./RECOVERED_FILES/Richard-Stallman.jpg ecb25c87f02bb0874246a166432bd3c4 ./RECOVERED_FILES/very_important_file.txt
this alone let’s me say – STAY AWAY FROM EXT4! 😀
what is all the speed in the world… if you can not recover your lost files?