If any files accidentally deleted and needs to be recovered. First look in lost+found folder.
If not found follow the below steps.
Mount the filesystem in read only to avoid any rewrites on the disk block
# mount -o remount ro /dev/sdx /mntpoint.
If the partition is a root filesystem - Boot the server in single user mode
# init 1
To recover a text file you can use grep command to recover the contents. For this you need to know any uniq word from the deleted file - Preferably the start of the file.
grep -a -B2 -A1000 'uniq_word' /dev/sdx > /tmp/filerecovered.txt
It means 2lines before the uniq_word found and 1000lines after the uniq_word found from the filesystem and save the content into filerecovered file. (ensure the destination folder is read-write mode.
===================
Recover other types of files
Use package foremost There is an excellent article published in howtoforge portal.
No comments:
Post a Comment