Image backup with deleted files

Question

I have accidentally deleted some files. With rm. It seems recovery is not so easy on Linux.

Is it some way I can do a image backup including the lost files (If they still exist)?

I should know the filesystem of course, don't remember - but its a regular company CentOS. Update: lvm2 pv.

Lost files are small text-files.

Lost... did you delete them? or overwrite them? or did you genuinely just forget where you put them? Details matter. Does any currently running process have them open by chance? — sam, May 27 '16 at 19:34
"Regular company CentOS" is meaningless to anyone outside of the place where you work. Please provide details. — Chris Davies, May 27 '16 at 19:37
Regarding duplicate questions... it is not so clear that a image will include blocks of deleted files? — Olav, May 28 '16 at 06:46

Luciano Andress Martini · Accepted Answer · 2016-06-15T19:05:12.200

2

You have two good options, foremost and extundelete.

extundelete - Is your first choice, it can recover the files with NAME!

foremost - is ugly, and recovery files by the sector number and type, but there is a better chance to recover. It will try to work even if the partition is damaged or with bad blocks, or of course in the entire disk if there is no partition anymore, it is formatted or a lot of other possibilities.

Both need the partition to be mounted read-only, and you will need a pendrive or another disk to save the recovered files.

A live -CD can help too for booting the system with the partition not mounted.

If you cant reboot your system, try using dd to create a image of your disk or partition in other place (bigger), never do this in the same disk or you will lost every chances for the recovery.

dd if=/dev/sda1 of=/mnt/otherbiggerpartition/test.img 
cd /mnt/otherbiggerpartition/
foremost test.img

or

extundelete test.img

(with this you wont need to umount the partition but the chances of data recovery is reduced, and you need a bigger partition or disk, that the raw image of partition can be saved.)

edited Jun 15 '16 at 19:05

answered May 27 '16 at 19:39

Luciano Andress Martini

6,628

IF they are using an extN filesystem, no? Otherwise would either work? – Chris Davies May 27 '16 at 20:51
foremost will work in every kind of filesystem, it will work even if filesystem does not exist anymore, because it search for the file headers in raw data, but i dont remember if it have a txt recovery option. Extundelete can work with txt but needs extN to work. – Luciano Andress Martini May 27 '16 at 20:56
Any of these work with a running partition? – Olav Jun 09 '16 at 09:21
Probably no, but you can image the partition and try to run it at the image. You need to image the partition in another disk or another partition directory, using dd. – Luciano Andress Martini Jun 09 '16 at 15:07
Important: Never recovery the files directly or copy anything in the affected partition. Use another partition or disk. – Luciano Andress Martini Jun 09 '16 at 15:16

Image backup with deleted files

1 Answers1