Recover files deleted with rsync -avz --delete

Question

Is it possible to recover files deleted with rsync -avz --delete? If it is, what are some suggested tools to do so?

Yes, restore from backup... This depends on your OS, filesystem, and possibly other details. This type of question isn't really on-topic on Stack Overflow. (Please _search_ on Super User. You'll find a lot of resources already there.) — Mat, Nov 01 '12 at 16:01
Sadly it was the backup files that were deleted. How can I move my question to Super User? I couldn't find a question on Super User describing this same situation (rsync --delete). I'm not sure if the manner in which files were deleted matters in this case, so I'm hesitant to try some ext4 file recovery tools. — Ben J, Nov 01 '12 at 16:55

score 6 · Answer 1 · edited Nov 01 '12 at 16:50

6

I am assuming you ran rsync on some unix system. If you don't have a backup of your file system, then its a long tedious process recovering deleted files from unix file system. High level steps :

find partition where your file resided
create image of entire partition % dd if=/partition of=partition.img .. (this assumes you have enough space to store this somewhere locally in a different partition, or you can copy it over to different system % dd if=/partition | ssh otherhost "dd of=partition.img")
open the img file in hex edit (this assumes you know the contents of the files that you've lost and can identify them when you see the content.)
note the byte offset and length of your file
use grep -b to extract the contents of your missing file.

enjoy!

edited Nov 01 '12 at 16:50

ruakh

175,680
26
273
307

answered Nov 01 '12 at 16:22

manish

315
1
3
9

Do you have any experience with some ext4 recovery tools such as testdisk or extundelete? Just wondering if one tool is more popular/successful. – Ben J Nov 01 '12 at 17:00
Taking a snapshot is really important and should be the first step. Possibly compress if it doesn't fit otherwise and see if you can mount it from within the compression. – Jonas Schäfer Nov 03 '12 at 14:31

score 3 · Accepted Answer · answered Nov 03 '12 at 14:27

3

I wasn't able to get extundelete to work, so I ended up using photorec + find/grep in order to recover my important files.

answered Nov 03 '12 at 14:27

Ben J

2,252
4
23
30

1

Hey, can you elaborate? – RAJ Oct 13 '14 at 06:20
What else do you want to know? – Ben J Oct 13 '14 at 19:03
@Skim Did using photorec + find/grep recover deleted files or did it just find copies of the files that existed elsewhere? – Scooter Dec 04 '14 at 04:32
photorec recovered deleted files. find/grep were needed since photorec chooses arbitrary names for the recovered files. – Ben J Dec 04 '14 at 22:06

Recover files deleted with rsync -avz --delete

2 Answers2