Hi all,

I have recently removed by mistake some very important files on a remote server that i manage. I have been trying to read up on how I can recover those files .
However I feel like I still don't know what am doing ,
I tried restoring the folder by using this command

But it did not restore it. besides the fact that i cannot unmount/remount that partition since its a remote one .

Any ideas i can solve my issue with ?

The server is a (ubuntu 14.04)

Please be forthcoming with and complete about information you share. The more relevant information you post the more efficient it is for us to help you.
- Most importantly: is this a Production environment or some expendable machine?
- Are backups made regularly, at what interval and is the restore procedure documented and tested?
- What files did you delete exactly?
- When did you delete them (aka how long have you been trying)?
- What kind of machine is this: physical hardware, virtual machine of which the host is under your control, cloud-based or what else?
- What kind of Out Of Band access / colo hands options do you have?


The reason you can't umount it probably is more because this is the root file system.

I am going to post a few comments for the community which confused me when running extundelete. Hopefully they can help you as well.

#1) The volume should be unmounted to avoid damage. I was struggling to find out what was holding my volume mounted, and used the lsof and fuser commands to find it out. You can also remount it read only with the command: mount -o remount,ro /dev/(your device.../sda6) You mentioned yours is remote, perhaps you can rebind it read only to a new device name? I'm not sure how to do this, just brainstorming.


#2) The command runs on the structure on the volume, not the actual mount point. So for example I had mounted a raid drive for "movies" on /mnt/raid/movies (mount /dev/md0 /mnt/raid)

I received the following errors:
extundelete: Operation not permitted while restoring file.
extundelete: Operation not permitted when trying to examine filesystem


The correct extundelete command for me was: extundelete /dev/md0 --restore-file movies/movie.mp4 (correct)
It was NOT extundelete /dev/md0 --restore-file /mnt/raid/movies/movie.mp4 (not correct)

#3) The restored files are put in a subdirectory of your current working directory

I had switched to the /tmp directory, so my file was restored to /tmp/RECOVERED_FILES/movies

I was doing a ls for the filename and I couldn't figure out where it went. It wasn't until I did a ls -sltr that I found the newly created directory.