ext4 recover deleted files (undelete) using ext4magic on CentOS 6

So the other day, I was helping a user get back some files that got deleted on the local disk of a CentOS 6.3 server. Here’s pretty much the steps I did:

  1. Unmount the partition: umount /tmp
  2. Make an image of the partition to work with on a partition that had enough space for it:
    1. cd /var/preserve
    2. dd if=/dev/mapper/vg_01-lv_tmp of=tmp_fs.img
    3. Or if you need to do it over the network you need to:
      ssh root@server “dd if=/dev/mapper/vg_01-lv_tmp” > tmp_fs.img
  3. Download and compile ext4magic at http://developer.berlios.de/projects/ext4magic/
    1. yum install e2fsprogs-devel uuid-devel libblkid-devel file-devel
    2. wget http://prdownload.berlios.de/ext4magic/ext4magic-0.3.1.tar.gz
    3. tar -xvpf ext4magic-0.3.1.tar.gz
    4. cd ext4magic-0.3.1
    5. ./configure
    6. make
  4. Since the files were delete 4 days ago, I decided to R recover (everything) after 5 days ago and before 2 days ago.
    1. sudo src/ext4magic -R \
      -a $(date -d “-5day” +%s) \
      -b $(date -d “-2day” +%s) \
      -d /var/preserve/RECOVER /var/preserve/tmp_fs.img

Boom, the files that I was looking for were in a MAGIC-1 directory since the missing files were in  directory tree that all got deleted.

This entry was posted in software and tagged , , , , . Bookmark the permalink.

2 Responses to ext4 recover deleted files (undelete) using ext4magic on CentOS 6

  1. hady zgheib says:

    hello i deleted all files of an installed package,when i try to reinstall it they say that the package all ready exist and installed how do i recover all deleted files to their original directories
    thank you

  2. Ryan says:

    I am not certain about your situation, but it sounds like you should force the package to be removed from yum’s database and then reinstall. What files of what package did you delete? What version of CentOS?

Leave a Reply

Your email address will not be published. Required fields are marked *