I used ext4 magic, replacement for extundelete and ext3grep:
http://openfacts2.berlios.de/
I have rpm's for CentOS 6 I downloaded from somewhere at:
http://rpms.plnet.rs/
http://rpms.p
1. First thing to do is to unmount that partition and stop using it. If it is root partition, shutdown system and boot LiveCD/LiveDV 6.x and work from it
2. Create a copy of your partition (to a filesystem where you have enough free space!):
# dd if=/dev/DEVICE of=/BACKUPPATH/DEVICE.img
3. Create a backup of ext3/ext4 Journal:
# debugfs -R "dump /BACKUPPATH/journal.copy" /dev/DEVICE
4. Download and install ext4magic rpm:
CentOS i386 - for 32-bit system/LiveCD:
# wget http://rpms.plnet.rs/
# yum install ext4magic-0.3.1-1.2.i686.rpm
CentOS 6 x86_64:
# wget http://rpms.plnet.rs/
# yum install ext4magic-0.3.1-1.2.x86_64.rpm
5a. Run ext4magic on the copy/dd-image to recover all deleted files (-m switch):
# ext4magic /BACKUPPATH/DEVICE.img -m -j /BACKUPPATH/journal.copy
5b. Run ext4magic on the actual partition (not recomended!):
# ext4magic /dev/DEVICE -j /BACKUPPATH/journal.copy -m
5c. Recovers all files deleted the last 24 hours from directory user1/ which have the stringjpg in their filename. The recovered files are stored at /LOCATION_TO_SAVE_FILES. A temporary file ./tmpfile is used to get the list of filenames to recover. :
# ext4magic /BACKUPPATH/DEVICE.img -Lx -f user1 | grep "jpg" > ./tmpfile
# ext4magic /BACKUPPATH/DEVICE.img -i ./tmpfile -r -d /LOCATION_TO_SAVE_FILES
5d. Since the files were delete 4 days ago, I decided to R recover (everything) after 5 days ago and before 2 days ago:
# ext4magic -R -a $(date -d “-5day” +%s) -b $(date -d “-2day” +%s) \ -d /LOCATION_TO_SAVE_FILES /BACKUPPATH/DEVICE.img
More help:
http://source.kohlerville.com/
You can use "man ext4magic" to get more help.
______________________________________________________________________________________
Click Back.. Click Home..