Extundelete is a powerful command-line utility designed to recover deleted files and directories from ext3 and ext4 file systems. It works by examining the file system journal to find information about deleted files and then attempts to restore them.

Recover Deleted Files

To recover a specific file, you need to know its path relative to the root of the partition. For example, to recover a file named SomeDirectory within the UserName directory, located on the /home partition mounted at /dev/sda4, you would use the following command:

extundelete /dev/sda4 --restore-file UserName/SomeDirectory

Restore Entire Directories

If you need to recover an entire directory and all its contents, Extundelete can handle that as well. This command will attempt to restore the specified directory and everything within it.

extundelete /dev/sda4 --restore-directory UserName/SomeDirectory

Recover Specific Inodes

For advanced users, Extundelete allows recovery based on inode numbers. You can find inode numbers using tools like debugfs. This method is useful when direct file path recovery is not feasible.

extundelete --restore-inode inode

Restore All Deleted Files

In situations where you need to recover all possible deleted files from a partition, Extundelete provides a comprehensive recovery option. This command scans the entire partition for recoverable data.

extundelete /dev/sda4 --restore-all

Important Considerations

• Unmount the partition: It is highly recommended to unmount the partition before attempting recovery to prevent further data overwrites.
• Target directory: Specify a different partition or external drive as the destination for recovered files to avoid overwriting the data you are trying to recover.
• File system type: Extundelete is specifically designed for ext3 and ext4 file systems.

External Resources

• Extundelete Man Page
• Ext4 Wiki
• GNU Parted (for partition management)