In the cases when you run a command like “rm *” unintentionally and you need to recover the files you just deleted then you can do the following. I’ve done the following on a ext4 file system in AWS. As soon as you realize you unintentionally deleted files do the following:
- Take a snapshot of the volume in AWS.
- Turn the snapshot into a volume.
- Attach the volume to an instance (I used a separate instance).
- Run “fsck <disk device>”, for me it was “fsck /dev/xvdh”
- Install “extundelete” through yum. Run “sudo yum install extundelete”.
- Navigate to a place for restoring files (e.g. /tmp).
- Then run “extundelete –restore-directory <path relative to previous mount> <disk device>”, for me it was “extundelete –restore-directory home/name/ /dev/xvdh”
- The entire directory of files was restored to a directory under RECOVERED_FILES.
While this worked for me and I hope it works for you, mileage may vary. Reference blog post that helped me do the above in AWS: http://blog.bisect.de/2011/08/how-to-undelete-files-from-ext3ext4.html