2

What's the best/fastest/safest way to recover deleted files from ext4 ?

Specs:

  • The disk is 1TB SSHD (hibrid HDD + SSD), also the partition is encrypted with LUKS Encryption (version 1)
  • Mongodb is using WiredTiger as a storage engine.

Also if I manage a partial recovery of files, could I do a partial recovery of mongo's collections?

Stefan Rogin
  • 1,499
  • 3
  • 25
  • 41

1 Answers1

1

Step 1: File recovery

Fast Recovery of files using extundelete:

sudo umount /path/to/disk && 
sudo extundelete /path/to/disk --restore-directory /path/to/dir -o /restored/path/
  • /path/to/disk represents the disk path, e.g. /dev/sdd , /dev/mapping/label
  • /path/to/dir represents the path that you want recovered relative to disk mounting point, e.g. if /dev/ssd would be mounted at /mnt/label/ the full path would be /mnt/label/path/to/dir and the relative path is /path/to/dir

pros of recovery with extundelete:

  • it's lightweight
  • can work if the disk is mounted or encrypted
  • pretty fast, it gave answers if recovery is possible in seconds and it writes the recovered files with over 100 MB/s

cons for data recovery in general

  • no guarantee for success
  • won't work if new data was written in the deleted sectors (so unmount the disk as soon as possible and make an image of the broken disk before any recovery)

Step 2 : repair mongodb if missing data

Backup before this step, mongod --repair could delete good data

Untested, but from my understanding mongod --repair should help repair the database if incomplete otherwise you can continue recovery for WiredTiger with :

Stefan Rogin
  • 1,499
  • 3
  • 25
  • 41