Recover files deleted with rsync -avz --delete

Question

Is it possible to recover files deleted with rsync -avz --delete? If it is, what are some suggested tools to do so?

Answer 1

I am assuming you ran rsync on some unix system. If you don't have a backup of your file system, then its a long tedious process recovering deleted files from unix file system. High level steps :

1. find partition where your file resided
2. create image of entire partition % dd if=/partition of=partition.img .. (this assumes you have enough space to store this somewhere locally in a different partition, or you can copy it over to different system % dd if=/partition | ssh otherhost "dd of=partition.img")
3. open the img file in hex edit (this assumes you know the contents of the files that you've lost and can identify them when you see the content.)
4. note the byte offset and length of your file
5. use grep -b to extract the contents of your missing file.

enjoy!

Answer 2

I wasn't able to get extundelete to work, so I ended up using photorec + find/grep in order to recover my important files.