In this example, we will assume a file named sample1 was deleted from /home/user1.
Unmount the home directory, to prevent a new file from being created using the same inode as the sample1 file.
[root@server1 ~]# umount /home
Determine the partition that has the /home directory. In this example, the /home directory is on /dev/sda3.
[root@server1 ~]# df Filesystem 1k-blocks Used Available Use% Mounted on /dev/sda1 1146788 17910 521781 8% / /dev/sda3 26123452 1271686 24184852 56% /home
Debug the /dev/sda3 file system. This will start the interactive debugfs prompt.
[root@server1 ~]# debugfs /dev/sda3 debugfs:
At the interactive debugfs prompt, type lsdel to list deleted files. Make note of the inodes of the deleted file. In this example, the inodes are 123456 and 789123.
debugfs: lsdel Inode Owner Mode Size Blocks Time deleted 123456 1000 100600 1234 3/ Mon Jan 1 06:22:15 2016 789123 1000 100600 123 1/ Mon Mar 7 17:34:26 2016 2 deleted inodes found.
Use the cat command to view the contents of deleted files.
Use the mi (modify inode) command to restore the file. Change the deletion time to 0 and the link count to 1.
debugfs: mi <123456>
Remount the directory.
[root@server1 ~]# mount /home
List the contents of /home/user1, and the file should now be restored.
[root@server1 ~]# ls -l /home/user1 sample1