Linux Accidental File Recovery: Stop the Bleeding First

Deleting files by mistake happens. The fastest recovery is to stop writing to the disk immediately — every new write can overwrite blocks that still hold the deleted data. This guide covers tools for ext3/ext4 and practical rollback steps.

Stop the bleed before touching anything

If the file lives on the same mounted partition, immediately unmount it or remount it read-only [1]:

sudo umount /dev/sda1
# or
sudo mount -o remount,ro /dev/sda1

If the disk is the root partition and cannot be unmounted, reduce risk by stopping services and avoiding new writes as much as possible.

extundelete: first choice for ext3/ext4

Install it and point it at the unmounted filesystem [2]:

sudo apt install extundelete
sudo extundelete /dev/sda1 --restore-file path/to/file.txt
sudo extundelete /dev/sda1 --restore-directory path/to/dir

It restores files into RECOVERED_FILES/ under the current directory. Use --after and --before to narrow the time window. Verified in documentation only: installation was not executed in this environment.

ext4magic: granular filters

sudo ext4magic /dev/sda1 -f path/to/file.txt -r

-r recovers to the working directory, and you can add -m for mtime filters or -a for atime. Not fully verified: not installed in this environment; confirmed against upstream docs.

testdisk: deeper, block-level search

When directory entry info is gone, use testdisk for a filesystem scan and file copy [3]:

sudo apt install testdisk
sudo testdisk /dev/sda1

Follow the menu: Analyse → Quick Search → mark files to copy. Verified in documentation only.

debugfs: manual inode recovery

sudo debugfs -R "lsdel" /dev/sda1
sudo debugfs -R "undelete <inode>" /dev/sda1

Use lsdel to list recently deleted inodes, then undelete by inode number. Not fully verified: not executed in this environment.

If all else fails

• Create a raw disk image first: sudo dd if=/dev/sda1 of=/mnt/backup/disk.img bs=4M.
• Run recovery tools against the image so the original disk never receives another write.

Rollback and risk

If recovery overwrites the wrong files, stop and snapshot the disk again before retrying. Do not mount the partition read-write until recovery is complete. The fastest path is still extundelete for ext3/ext4; for XFS, Btrfs, or NTFS, use xfs_undelete, btrfs restore, or ntfsundelete respectively.

Not fully verified: original source linux.zaixianjisuan.com was blocked by Baidu WAF; all commands are documented on official sites but have not been hands-on executed in this environment.

References

• [1] umount(8)
• [2] extundelete docs
• [3] TestDisk wiki

Commands verified against official documentation only; installation and hands-on execution have not been performed in this environment.