PDA

View Full Version : Recover old file



roger3
21st October 2012, 12:23 PM
Hi everyone:

How can I recover old file deleted?


Thanks

:D:dance::doh:

beaker_
21st October 2012, 01:06 PM
Have you tried extundelete?

Dutchy
21st October 2012, 01:15 PM
How can I recover old file deleted?
Just copy it from your backup. ;p

Or try extundelete with the --restore-file(s) option.

roger3
21st October 2012, 01:52 PM
OK thanks, I know what is console code for use extundelete

But after I install it where will be install it?

I can not find it

Thanks

beaker_
21st October 2012, 02:29 PM
It's ran from a terminal. Also, you do not mount the partition. ie., use a live disc if the partition is normally mounted such as root.

man extundelete

---------- Post added at 10:29 AM ---------- Previous post was at 10:24 AM ----------

Look for the "how to use" section.
http://extundelete.sourceforge.net/

roger3
21st October 2012, 02:47 PM
Ok but how can I use it?

beaker_
21st October 2012, 03:05 PM
You start by reading the link I provided. Then you look at any help extundelete provides

For ex.,


# extundelete --help
Usage: extundelete [options] [--] device-file
Options:
--version, -[vV] Print version and exit successfully.
--help, Print this help and exit successfully.
--superblock Print contents of superblock in addition to the rest.
If no action is specified then this option is implied.
--journal Show content of journal.
--after dtime Only process entries deleted on or after 'dtime'.
--before dtime Only process entries deleted before 'dtime'.
Actions:
--inode ino Show info on inode 'ino'.
--block blk Show info on block 'blk'.
--restore-inode ino[,ino,...]
Restore the file(s) with known inode number 'ino'.
The restored files are created in ./RESTORED_FILES
with their inode number as extension (ie, file.12345).
--restore-file 'path' Will restore file 'path'. 'path' is relative to root
of the partition and does not start with a '/' (it
must be one of the paths returned by --dump-names).
The restored file is created in the current
directory as 'RECOVERED_FILES/path'.
--restore-files 'path' Will restore files which are listed in the file 'path'.
Each filename should be in the same format as an option
to --restore-file, and there should be one per line.
--output-dir 'path' Restore files in the output dir 'path'.
By default the restored files are created under current directory 'RECOVERED_FILES'.
--restore-all Attempts to restore everything.
-j journal Reads an external journal from the named file.
-b blocknumber Uses the backup superblock at blocknumber when opening
the file system.
-B blocksize Uses blocksize as the block size when opening the file
system. The number should be the number of bytes.


By then you should understand enough to either:
A. Decide it's the appropriate tool for the job and then
.... a. Determine what steps to take wrt the partition in question
.... b. Cross fingers and hope data hasn't been overwritten already
.... c. Try and recover something, hope for the best
B. Decide it's more work than it's worth and forget about it all together

good luck

Penguinclaw
21st October 2012, 07:36 PM
I have used and recommend photorec. Despite its name it can recover much about anything I've thrown at it. It even managed to save data from a totally corrupted sd card that nothing else could read. You will need to use it from a live cd so try SystemRescue a great recovery distro:

http://www.sysresccd.org/SystemRescueCd_Homepage

Good luck!