Data recovery from accidentally deleted files or crashed drives in Redhat, CentOS and Fedora Linux

Want to support HowtoForge? Become a subscriber!
 
Submitted by srijan (Contact Author) (Forums) on Wed, 2014-04-02 09:06. :: CentOS | Fedora

Data recovery from accidentally deleted files or crashed drives in Redhat, CentOS and Fedora Linux

Version 2.0
Author: Srijan Kishore 
Last edited 1/Apr/2014

This tutorial will help you to recover data from accidentally deleted data from Linux-file systems. This is a very drastic mistake by any user/admin which costs for huge penalties. This script will be a boon for newbies/expert for data management. I will be using TestDisk for data-recovery. Here I have simplified the task with the help of a script.

1. Background

TestDisk is a powerful free data recovery software. Suppose you have a ext3/ext4 drive which got crashed/deleted with rm -rf or shift+delete like commands, with the help of TestDisk you can recover the data/file.
TestDisk can be used to
  • Fix partition table
  • Undelete files from FAT, exFAT, NTFS and ext2/ext3/ext4 partitions

Beside these functions TesdDisk have several functionality for the data maintenance/management

2. Requirement

I am using CentOS on which I will be installing the TestDisk & implement the data recovery script on a crashed drive. This script works fine with the CentOS/Fedora/Redhat. Even if it happens that any of the harddisk gets deleted just connect the harddisk with the CentOS machine & run the script to recover the data.

3. Script

#!/bin/bash
#######################################################################################################
#######################################################################################################
#######################################################################################################
######                                                                                          #######
######                                                                                          #######
######                 This script will help you to recover the accidentally                    #######
######                     deleted data from crashed linux file systems                         #######
######                                     Version-2                                            #######
######                          Script created by (Srijan Kishore)                              #######
######                                                                                          #######
######                                                                                          #######
#######################################################################################################                                                                                       
#######################################################################################################
#######################################################################################################


# User Check

if [ "$USER" = 'root' ]
    then

whiptail --title "User check" --msgbox "User is root, you can execute the script successfully." 8 78
             
        echo "User is root, you can execute the script successfully"
    else
whiptail --title "User check" --msgbox "User is not Root. Please run the script as root user." 8 78

        
        echo "User is not Root. Please run the script as root user."
        exit 1
fi


# Check your operating system

cat /etc/redhat-release >> /dev/null 
if [ "$?" = 0 ]
    then

whiptail --title "Your OS" --msgbox "You are using CentOS/Redhat/Fedora" 8 78
echo "You are using CentOS/Redhat/Fedora"

    else

whiptail --title "Your OS" --msgbox "You are not using CentOS/Redhat/Fedora.You can download the TestDisk from this link http://www.cgsecurity.org/wiki/TestDisk_Download" 8 78

    echo "You are not using CentOS/Redhat/Fedora.You can download the TestDisk from this link http://www.cgsecurity.org/wiki/TestDisk_Download"
    exit 1        
fi

#adding repo
ver=`cat /etc/redhat-release | cut -d " " -f3 | cut -d "." -f1`
ls -l /etc/yum.repos.d/rpmforge*

if [ "$?" != 0 ]
    
    then
    whiptail --title "Repository requirement" --msgbox "You need to add rpmforge repository to install testdisk" 8 78
        if [[ `uname -i` = 'i386' && $ver = 6 ]]
            then 
            echo "you are running i386 with 6 version"
            yum install -y http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el6.rf.i686.rpm
        fi

        if [[ `uname -i` = 'x86_64' && $ver = 6 ]]
            then 
            echo "you are running i386 with 6 version"
            yum install -y http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el6.rf.x86_64.rpm
        fi

        if [[ `uname -i` = 'i386' && $ver = 5 ]]
            then 
            echo "you are running i386 with 5 version"
            yum install -y http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el5.rf.i386.rpm
        fi

        if [[ `uname -i` = 'x86_64' && $ver = 5 ]]
            then 
            echo "you are running x86_64 with 5 version"
            yum install -y http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el5.rf.x86_64.rpm
        fi

        if [[ `uname -i` = 'x86_64' && $ver = 4 ]]
            then 
            echo "you are running i386 with 4 version"
            yum install -y http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el4.rf.i386.rpm
        fi

        if [[ `uname -i` = 'x86_64' && $ver = 4 ]]
            then 
            echo "you are running x86_64 with 4 version"
            yum install -y http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el4.rf.x86_64.rpm
        fi
else
whiptail --title "Repository requirement" --msgbox "You already have TestDisk repos configured" 8 78
echo "You already have TestDisk repos configured"
fi


# TestDisk installation
testdisk --version >> /dev/null
if [ "$?" = 0 ]
    then
    whiptail --title "Info" --msgbox "Testdisk already installed" 8 78
    echo "Testdisk already installed"
    else
    whiptail --title "Info" --msgbox "Testdisk not installed, installing Testdisk" 8 78
        echo "Testdisk not installed, installing Testdisk"

    yum install -y testdisk
fi
   

#Recovery part of deleted files


ls -l /root/result/lostfiles
if [ $? != 0 ]
    then
    mkdir -p /root/result/lostfiles
    whiptail --title "Data recovery" --msgbox "You are proceeding towards recovering the data from the lost drive. Please select the affected drive to get the data recovered" 8 78
    photorec /d /root/result/lostfiles

    else        
    whiptail --title "Folder Exists" --msgbox "There is already an existing folder viz /root/result/lostfiles, you are adviced to rename/remove the folder to allow the data recovery process" 8 78        
exit 2
fi

#File filtering
 
user=`ps aux | grep gnome-session | grep -v grep | head -1 | cut -d " " -f1`
mkdir "/home/recovered_output"
mkdir "/home/recovered_output/Debians"
mkdir "/home/recovered_output/rpms"
mkdir "/home/recovered_output/conf_files"
mkdir "/home/recovered_output/exe"
mkdir "/home/recovered_output/binaries"
mkdir "/home/recovered_output/Docs"
mkdir "/home/recovered_output/Pdfs"
mkdir "/home/recovered_output/Mbox"
mkdir "/home/recovered_output/Images"
mkdir "/home/recovered_output/Videos"
mkdir "/home/recovered_output/Sound"
mkdir "/home/recovered_output/ISO"
mkdir "/home/recovered_output/Excel"
mkdir "/home/recovered_output/Presentation"
mkdir "/home/recovered_output/Web_Files"
mkdir "/home/recovered_output/Archives"
mkdir "/home/recovered_output/Others"


#Sorting the Recovered data


find /root/result/ -name "*.doc"    -type f  -exec mv {} "/home/recovered_output/Docs/" \;
find /root/result/ -name "*.docx"   -type f  -exec mv {} "/home/recovered_output/Docs/" \;
find /root/result/ -name "*.odt"    -type f  -exec mv {} "/home/recovered_output/Docs/" \;
find /root/result/ -name "*.pdf"    -type f  -exec mv {} "/home/recovered_output/Pdfs/" \;
find /root/result/ -name "*.mbox"   -type f  -exec mv {} "/home/recovered_output/Mbox/"  \;
find /root/result/ -name "*.png"    -type f  -exec mv {} "/home/recovered_output/Images/" \;
find /root/result/ -name "*.jpg"    -type f  -exec mv {} "/home/recovered_output/Images/" \;
find /root/result/ -name "*.jpeg"   -type f  -exec mv {} "/home/recovered_output/Images/" \;
find /root/result/ -name "*.gif"    -type f  -exec mv {} "/home/recovered_output/Images/" \;
find /root/result/ -name "*.avi"    -type f  -exec mv {} "/home/recovered_output/Videos/" \;
find /root/result/ -name "*.mpeg"   -type f  -exec mv {} "/home/recovered_output/Videos/" \;
find /root/result/ -name "*.mp4"    -type f  -exec mv {} "/home/recovered_output/Videos/" \;
find /root/result/ -name "*.mkv"    -type f  -exec mv {} "/home/recovered_output/Videos/" \;
find /root/result/ -name "*.webm"   -type f  -exec mv {} "/home/recovered_output/Videos/" \;
find /root/result/ -name "*.wmv"    -type f  -exec mv {} "/home/recovered_output/Videos/" \;
find /root/result/ -name "*.flv"    -type f  -exec mv {} "/home/recovered_output/Videos/" \;
find /root/result/ -name "*.mp3"    -type f  -exec mv {} "/home/recovered_output/Sound/" \;
find /root/result/ -name "*.wav"    -type f  -exec mv {} "/home/recovered_output/Sound/" \;
find /root/result/ -name "*.deb"    -type f  -exec mv {} "/home/recovered_output/Debians/" \;
find /root/result/ -name "*.bin"    -type f  -exec mv {} "/home/recovered_output/binaries/" \;
find /root/result/ -name "*.exe"    -type f  -exec mv {} "/home/recovered_output/exe/" \;
find /root/result/ -name "*.rpm"    -type f  -exec mv {} "/home/recovered_output/rpms/" \;
find /root/result/ -name "*.conf"   -type f  -exec mv {} "/home/recovered_output/conf_files" \;
find /root/result/ -name "*.iso"    -type f  -exec mv {} "/home/recovered_output/ISO/" \;
find /root/result/ -name "*.xls"    -type f  -exec mv {} "/home/recovered_output/Excel/" \;
find /root/result/ -name "*.xlsx"   -type f  -exec mv {} "/home/recovered_output/Excel/" \;
find /root/result/ -name "*.csv"    -type f  -exec mv {} "/home/recovered_output/Excel/" \;
find /root/result/ -name "*.ods"    -type f  -exec mv {} "/home/recovered_output/Excel/" \;
find /root/result/ -name "*.ppt"    -type f  -exec mv {} "/home/recovered_output/Presentation/" \;
find /root/result/ -name "*.pptx"   -type f  -exec mv {} "/home/recovered_output/Presentation/" \;
find /root/result/ -name "*.odp"    -type f  -exec mv {} "/home/recovered_output/Presentation/" \;
find /root/result/ -name "*.html"   -type f  -exec mv {} "/home/recovered_output/Web_Files/" \;
find /root/result/ -name "*.htm"    -type f  -exec mv {} "/home/recovered_output/Web_Files/" \;
find /root/result/ -name "*.jsp"    -type f  -exec mv {} "/home/recovered_output/Web_Files/" \;
find /root/result/ -name "*.xml"    -type f  -exec mv {} "/home/recovered_output/Web_Files/" \;
find /root/result/ -name "*.css"    -type f  -exec mv {} "/home/recovered_output/Web_Files/" \;
find /root/result/ -name "*.js"     -type f  -exec mv {} "/home/recovered_output/Web_Files/" \;
find /root/result/ -name "*.zip"    -type f  -exec mv {} "/home/recovered_output/Archives/" \;
find /root/result/ -name "*.tar"    -type f  -exec mv {} "/home/recovered_output/Archives/" \;
find /root/result/ -name "*.rar"    -type f  -exec mv {} "/home/recovered_output/Archives/" \;
find /root/result/ -name "*.gzip"   -type f  -exec mv {} "/home/recovered_output/Archives/" \;
find /root/result/ -name "*.tar.gz" -type f  -exec mv {} "/home/recovered_output/Archives/" \;
find /root/result/ -name "*.7z"     -type f  -exec mv {} "/home/recovered_output/Archives/" \;
find /root/result/ -name "*.bz"     -type f  -exec mv {} "/home/recovered_output/Archives/" \;
find /root/result/ -name "*.bz2"    -type f  -exec mv {} "/home/recovered_output/Archives" \;
find /root/result/ -name "*.*"      -type f  -exec mv {} "/home/recovered_output/Others/" \;

#Finalization
whiptail --title "Congratulations" --msgbox "You have successfully recovered your data in folder /home/recovered_output cheers :)" 8 78
echo "You have successfully recovered your data in folder /home/recovered_output cheers :)"
exit 0
      

4. Script Execution

Simply copy the above script & paste in file viz. script.sh & give the execute  permissions to the script.

chmod +x script.sh

Note: Please run the script with root by using the command

su -                                        #### Put your root password##########

Run the script & it will guide you further.

sh script.sh

5. Finalization

Firstly script will confirm that whether the user running the script is root, then it will check for the TestDisk tool installation which includes automatic repository addition. It will redirect you to the drive selection page for the data recovery.

Click to enlarge


It will check your OS.

Click to enlarge

Script will automatically verify & add the required repository for TestDisk.

Click to enlarge


Script will check the installation for the TestDisk.

Click to enlarge



Click to enlarge


Select the drive which you want to recover.

Click to enlarge


Click to enlarge


Click to enlarge



Click to enlarge


After process completion, quit on the screen.

Click to enlarge



Click to enlarge



Click to enlarge




Cheers you have recovered your data.

Please do not use the comment function to ask for help! If you need help, please use our forum.
Comments will be published after administrator approval.
Submitted by ishasharma (not registered) on Wed, 2014-04-16 10:47.
Really helpful info for redhat, linux and CentOS users. because lot of time we get panic when our data is lost. thanks for sharing.
Submitted by r.vignesh (registered user) on Thu, 2014-04-10 11:27.

 

 67         if [[ `uname -i` = 'x86_64' && $ver = 6 ]]

 68             then

 69             echo "you are running i386 with 6 version"


Submitted by Anonymous (not registered) on Wed, 2014-04-02 18:37.

You forgot to mention a very important caveat:

 

TestDisk is very limited in the types of files it can recover.

Submitted by Anonymous (not registered) on Tue, 2014-04-08 05:48.

Very important you dont need this script for running you own server/system test disk.

 just unzip and you have executable file to from testdisk. you may good with writing script but this was not required.