6 thoughts on - How To Restore Deleted Directory/files

• If you don’t have backups, then you’re pretty much out of luck. Don’t forget to back up any data that is important, and test your backups regularly!

  Depending on the filesystem, there might be ways to recover it, but the first thing you need to do is stop using the disk the files were on. Power it off. There are some tools that you can use to recover it, but it’s not 100% effective.

  If it’s very important and you are willing to spend money, there are data recovery services that might be able to extract the data.

• Hi,

  Thanks for your reply. The file system type is xfs. And I found xfsdump/xfsrestore can undo the remove.

  I use dd to copy the partition as one image file. How do I mount the image as read-only device? Then I can try to recover the deleted files/directory anytime.

  Thanks!

  Regards

  Andrew

  At 2020-09-16 20:36:44, “Jonathan Billings” wrote:

• Hm, are you sure you can use xfsdump/xfsrestore for this?

  Mount the image with the option ‘-o ro’ as read-only.

  Depending on the kind of data you removed you could use ‘testdisk’ or
  ‘photorec’ to recover. Make sure to only use a copied image to test.

  Regards, Simon

• Hi,

  xfsdump/xfsrestore can’t do the recovery.

  Thanks for your advice. I will try the tools.

  I also found the article about how to create and mount image.

  https://midnightprogrammer.net/post/create-mount-and-unmount-img-files-in-ubuntu/

  The article says, the image file created by dd should formated in ubuntu.

  For CentOS, should I format the image file before mounting it as virtual read-only disk?

  Thanks!

  Regards

  andrew

  At 2020-09-16 21:32:49, “Simon Matter” wrote:

• You generally don’t want to mount it at all, it won’t help you recover anything.

  The article is for creating a fresh, unformatted disk image and mounting it via the loopback. Since this image is already formatted, you’d just be deleting data by formatting it.

  Anyway, you don’t generally need to mount anything if you’re using photorec or similar tools.

• 1. restore from latest backup.

  2. if you are very facile with Linux, then you culd try

  a. remount read only the mount point where removed directory/file lives
  (every write may obliterate some of removed stuff) – AS SOON AS POSSIBLE
  b. make dd copy of the whole partition (underlying device actually) to file, make another copy of that, and use filesystem debugging tools to undo what your “rm -rf …” did on that copy.

  But this option is for experts in the field, which judging from your question you are not, so go to 1. Or go to 3.

  3. send drive to one of commercial recovery companies. They charge a lot
  ($1000 will be good of least expensive ones, who charge much less are likely just frauds), the real ones, as they will try to do what is in 2.

  If you need advise on recovery companies, I can give some, though my own plan always is: I have a good backup.

  Valeri