Need to recover a file using extundelete. Is there any risk about running it without unmounting, aside from that the partition might keep writing?

Question

I need to recover a few files from a Linux machine. These files are important, but not enough to warrant dismounting the partition. Is there any risk from running on a mounted partition, except from the obvious about recovery that the free space might get overwritten? I couldn't find anything.

Answer 1

Thankfully, Linux has its own swap partition, so you don't have a pagefile which could grow and take up the used space. That being said, logs are being written quite frequently (/var/log), so you should do the recovery sooner rather than later. You also need to determine if there's other potential disk writes that the system does - is it a LAMP system? Does Apache accept file uploads? Is there an active database that has a potential to grow? Do you have any FTP servers running? Perhaps rtorrent downloading a whole bunch of stuff? You need to take all these possibilities into consideration before determining how long you should leave it.

If you had absolutely no disk activity, then you could leave it several months before you attempted to recover - but that's never the case of an active operating system.

Essentially, to answer your question, there is no risk other than the disk writes which may occur.