ext3grep - ext3 file recovery tool

       ext3grep was written by Carlo Wood <carlo@alinoe.com>.

       This  manual  page was written by Rich Ercolani <rercola@acm.jhu.edu>, for the Debian project (but may be
       used by others). It may be distributed under the same terms as ext3grep, the GNU General Public  License,
       either version 2 or (at your option) any later version.

0.8.0                                              2008-09-14                                        EXT3GREP(8)

       ext3grep  is  a simple tool intended to aid anyone who accidentally deletes a file on an ext3 filesystem,
       only to find that they wanted it shortly thereafter.

Restoringallfilesfromtheext3partition/file/backup/sda1:
       ext3grep --restore-all /backup/sda1
       ListingthefilesownedbyGID1000on/backup/sda1:
       ext3grep --ls --group 1000 /backup/sda1
       FindingallfilescontainingthestringCritical_reportintheirnameon/backup/sda1:
       ext3grep --dump-names /backup/sda1 | grep 'Critical_report'

       Do not attempt to use ext3grep for recovery from a mounted filesystem. Ever.

       No, not even then.

       ext3grep sometimes runs out of memory spare on 32-bit architectures and crashes. It is highly recommended
       that you run ext3grep in a 64-bit environment when dealing with large filesystems, though this is seen as
       a bug.

       ext3grep cannot recover files if there are no remnants of them.

       Some files that ext3grep recovers may have trailing null bytes - just scrape them off like the burnt bits
       on toast.

       ext3grep - ext3 file recovery tool

--superblock
           Print contents of superblock in addition to the rest. If no action is specified then this  option  is
           implied.

       --print
           Print contents of block or inode, if any.

       --ls
           Print directories, one line per entry. See the FILTERS section for details on filtering this output.

       --acceptFILE
           Accepts  'file'  as a legal filename. Can be used multiple times. If you change any --accept you must
           remove BOTH stage* files!

       --journal
           Prints the contents of the journal.

       --show-path-inodes
           Show the inode of each directory component in paths.

   Filters:--groupgid
           Only show/process files owned by process group gid.

       --directory
           Only show/process process directory inodes.

       --afterdtime
           Only show/process entries deleted on or after dtime.

       --beforedtime
           Only show/process entries deleted before dtime.

       --deleted
           Only show/process deleted entries.

       --allocated
           Only show/process allocated inodes/blocks.

       --unallocated
           Only show/process unallocated inodes/blocks.

       --reallocated
           Do not suppress entries with reallocated inodes. Inodes are considered 'reallocated' if the entry  is
           deleted  but  the  inode is allocated, but also when the file type in the dir entry and the inode are
           different.

       --zeroed-inodes
           Do not suppress entries with zeroed inodes. Linked entries  are  always  shown,  regardless  of  this
           option.

       --depth depth
           Process directories recursively up till a depth of 'depth'.

   Actions:--inode-to-blockinode_num
           Print the block that contains inode inode_num.

       --inodeinode_num
           Show info on inode inode_num. If --ls is used and the inode is a directory, then the filters apply to
           the entries of the directory. If you do not use --ls then --print is implied.

       --blockblock_num
           Show  info  on block block_num. If --ls is used and the block is the first block of a directory, then
           the filters apply to entries of the directory. If you do not use --ls then --print is implied.

       --histogram=[atime|ctime|mtime|dtime|group]
           Generate a histogram based on the given specs. Using atime, ctime or mtime will change the meaning of
           --after and --before to those times.

       --journal-blockblock_num
           Show info on journal block block_num.

       --journal-transactionseq
           Show info on transaction with sequence number seq.

       --dump-names
           Write the paths of files to stdout. This implies --ls but suppresses its output.

       --search-startstr
           Find blocks that start with the fixed string str.

       --searchstr
           Find blocks that contain the fixed string str.

       --search-inodeblock_num
           Find inodes that refer to block block_num.

       --search-zeroed-inodes
           Return allocated inode table entries that are zeroed.

       --inode-dirblock-tabledir
           Print a table for directory path dir of directory block numbers found and the inodes  used  for  each
           file.

       --show-journal-inodesinode_num
           Show copies of inode inode_num still in the journal.

       --restore-filepath
           Will  restore  file path. path is relative to root of the partition and does not start with a '/' (it
           must be one of the paths returned by --dump-names). The restored directory, file or symbolic link  is
           created in the current directory as ./path.

       --restore-all
           As  --restore-file  but  attempts  to  restore  everything.  The use of --after is highly recommended
           because the attempt to restore very old files will only result in them being hard linked  to  a  more
           recently deleted file and as such pollute the output.

       --show-hardlinks
           Show all inodes that are shared by two or more files.

       --version, -[vV]
           Prints the version information and exits.

       --help,
           Prints a help message and exits.

debugfs(8)

ext3grep [OPTIONS] FILE ...