Ubuntu – Undelete files on ext4

ext4undelete

My mother has placed some important files on her /tmp per accident. Now, of course, they are gone.

This happened yesterday (2 boots of the machine since)

I want to try to undelete the files. They were on /tmp, which was on the same partition as the rest of / , so I need a tool that runs on a mounted system (or maybe I could use a livecd …)

Right now, I am trying testdisk on a systemrescuecd that I just downloaded. I can get some files from /tmp, but not all. (is it the right tool ? What exactly are those "red" files ? are only some of them recoverable ?)

Best Answer

  • You can also use extundelete

    First unmount (umount) the file system where the files have been deleted.
    Then read the chapter What to do if you've deleted a file.

    You can install extundelete from classic Ubuntu repository:

    sudo apt-get install extundelete
    

    Or better, you can download the latest version and compile it:

    cd ~/Download
    tar -xf extundelete-*.*.*-.tar.bz2  #Replace *.*.* by the version
    cd      extundelete-*.*.*
    sudo apt-get install e2fslibs-dev   #Required for compilation
    ./configure
    make
    sudo make install
    extundelete --version               #Should be your *.*.* version
    

    Example of usage: restore all deleted files from directory Images into new created directory restore

    sudo extundelete --restore-directory Images/ -o restore /dev/sda3
    

    Bad news if you see your file XXXX within the following format:

    Unable to restore inode NNN (Images/XXXX): Space has been reallocated.
    

    See all restored files (look for your file):

    find restore -name '*'
    

    Backup your file(s) and remove this temporary directory restore

    cp restore/Images/XXXX MY_BACKUP_DIRECTORY
    sudo rm -rf restore  
    
  • Related Question