Resurrect Your Lost Files: The Magic of the “extundelete” command

Posted on by Tech Bytes With Suyash

extundelete is a powerful Linux utility designed to recover deleted files from ext3 and ext4 filesystems. It works by scanning the filesystem for traces of deleted files and restoring them, provided the data blocks haven’t been overwritten.

Key Features:

  • Recover Individual Files or Entire Partitions: Restore specific files or entire directories.
  • Works on Ext3 and Ext4: Supported filesystems are ext3 and ext4.
  • Requires Superuser Privileges: Works best with sudo to access disk blocks directly.

Installation:

  • On Debian/Ubuntu-based systems:

sudo apt update
sudo apt install extundelete

  • For CentOS/RHEL:
    You may need to compile from source, as it’s not always in default repositories.

Usage:

  • Unmount the Partition:
    Before using extundelete, unmount the partition to prevent overwriting data.

sudo umount /dev/sdX

  • Basic Syntax:

sudo extundelete /dev/sdX [options]

Common Options:

  • Restore All Files:

sudo extundelete /dev/sdX --restore-all

Recovers all deleted files on the partition.

  • Restore Specific File:

sudo extundelete /dev/sdX --restore-file path/to/file

Recovers a specific file (e.g., /home/user/document.txt).

  • Restore a Directory:

sudo extundelete /dev/sdX --restore-directory path/to/directory

  • Dry Run (Preview Before Recovery):

sudo extundelete /dev/sdX --inode 12345

Lists inode details without recovering.

Practical Example:

Imagine you accidentally deleted /home/user/important.txt on /dev/sda1:

  • Unmount the partition:

sudo umount /dev/sda1

  • Recover the file:

sudo extundelete /dev/sda1 --restore-file /home/user/important.txt

  • Recovered files are placed in the RECOVERED_FILES directory.

Limitations:

  • Not for NTFS/FAT: Only works with ext3/ext4 filesystems.
  • Depends on Disk State: If data blocks are overwritten, recovery is unlikely.
  • No Live Recovery: Partition must be unmounted.

Pro Tips:

  • Act Fast: Data recovery is more successful if the filesystem remains unchanged after deletion.
  • Backup Regularly: Tools like rsync can help prevent such scenarios.
  • Use testdisk or photorec as alternatives for other filesystems.

Thanks for reading this article. Please follow me on threads https://threads.net/@techbyteswithsuyash

Post Views: 24

Related Posts