Restoring Accidentally Deleted Data Using Extundelete (Linux)

Application Scenarios

You can use Extundelete to restore accidentally deleted files. Extundelete is a utility that can restore deleted files from an ext3 or ext4 partition.

Whether deleted files can be restored are determined by the following factors:

• Whether data in the files is overwritten after being deleted
• Whether metadata is stored in journal

If the accidentally deleted files were stored in the system disk and data was continuously written into the files after deletion, the files cannot be restored using Extundelete.

To improve data security, you are advised to periodically back up data. For details, see Creating a Snapshot, Creating a Private Image, and Creating a Cloud Disk Backup.

The following uses an ECS running CentOS 7.5 as an example to describe how to use the open-source tool Extundelete to quickly restore accidentally deleted data.

Prerequisites

Before restoring data, complete the following preparations:

• Back up data by referring to Creating a Snapshot and Creating a Private Image to ensure that data can be restored to its original state if an error occurs during data restoration.
• Stop writing data to the file system. If you want to restore a data disk, unmount it first.

Procedure

1. Install Extundelete.
   1. Log in to the ECS.
   2. Run the following commands in sequence to install Extundelete dependencies and libraries:

      yum install libcom_err e2fsprogs-devel

      yum install gcc gcc-c++

   3. Type y when the following information is displayed:

      Installed size: 25 M
      Is this OK [y/d/N]: y

   4. Run the following command to download the Extundelete source code:

      wget https://github.com/curu/extundelete/archive/refs/tags/v1.0.tar.gz

   5. Run the following command to decompress v1.0.tar.gz:

      tar xf v1.0.tar.gz

   6. Run the following commands in sequence to compile and install Extundelete:

      cd extundelete-1.0

      ./configure

      make

   7. Run the following command to go to the src directory and view the compiled Extundelete file:

      cd ./src

2. Run the following command to restore data:

   ./extundelete --restore-all /dev/partition

   The data is restored in RECOVERED_FILES in the same directory.