How to recover accidentally deleted files in Linux system

Option 1) Now I will introduce to you how to use extundelete to restore files (ext4 suitable for rhel6. sda4 --inode 2 (See the files you deleted)

Restore a single directory:

extundelete /dev/sdb1 --restore-directory /mongodb ##mongodb is a directory

Recover all accidentally deleted files:

extundelete /dev/sdb1 --restore-all

Restore a single file:

extundelete /dev/sdb1 --restore-file a.txt

Option 2) Use the mysterious function that comes with lsof

Principle: Most of the information related to lsof is stored in the directory named after the PID of the process. If the /var/log/messages file is deleted due to misoperation, then the /var/log/messages file must be deleted. The recovery method

is as follows:

First use lsof to check whether there is a process currently opening the /var/logmessages file, as follows:

# lsof |grep /var/log/messages

syslogd 1283 root 2w REG 3,3 5381017 1773647 /var/log/messages (deleted)

From the above information, you can see that the file descriptor of the file opened by PID 1283 (syslogd) is 2. At the same time, you can also see that /var/log

/messages has been marked for deletion.

Recovery:

cat /proc/1283/fd/2 > /var/log/messages Recovery successful

For many applications, especially log files and databases, this recovery of deleted files method is very useful.