Recover files deleted with rsync -avz --delete
-
25-07-2021 - |
Question
Is it possible to recover files deleted with rsync -avz --delete? If it is, what are some suggested tools to do so?
Solution 2
I wasn't able to get extundelete to work, so I ended up using photorec + find/grep in order to recover my important files.
OTHER TIPS
I am assuming you ran rsync on some unix system. If you don't have a backup of your file system, then its a long tedious process recovering deleted files from unix file system. High level steps :
- find partition where your file resided
- create image of entire partition
% dd if=/partition of=partition.img ..
(this assumes you have enough space to store this somewhere locally in a different partition, or you can copy it over to different system% dd if=/partition | ssh otherhost "dd of=partition.img"
) - open the img file in hex edit (this assumes you know the contents of the files that you've lost and can identify them when you see the content.)
- note the byte offset and length of your file
- use
grep -b
to extract the contents of your missing file.
enjoy!
Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow