Monday, September 13, 2010
10:34 AM

Utility to recover deleted files from an ext3 or ext4 Linux partition - Extundelete

Extundelete is a utility that can recover deleted files from an ext3 or ext4 partition. The ext3 file system is the most common file system when using Linux, and ext4 is its successor. extundelete uses the information stored in the partition's journal to attempt to recover a file that has been deleted from the partition. There is no guarantee that any particular file will be able to be undeleted, so always try to have a good backup system in place, or at least put one in place after recovering your files!

Download and Install Extundelete:
Download the latest version of Extundelete - here

To compile and install Extundelete, you should first install the binary and development packages for e2fsprogs and e2fslibs.  You must also have a C++ compiler and a make utility to compile extundelete.
Go to terminal and type following command to install Extundelete:

tar -xjf extundelete-0.2.0.tar.bz2
cd extundelete-0.2.0
./configure
make

The extundelete program may be run as-is from the build directory, or you may wish to install it to a directory that is shared with other executable programs, which you may do by running the following command: make install

Using 
extundelete:
Assume you have deleted a file called /home/user/an/important/file. Also assume the output of the 'mount' command shows this line (among others):

/dev/sda3 on /home type ext3 (rw)

This line shows that the /home directory is on the partition named /dev/sda3, so then run: 
umount /dev/sda3 and check that it is now unmounted by running the mount command again and seeing it is not listed.Now, with this information, run extundelete:
# extundelete /dev/sda3 --restore-file user/an/important/file

If you have deleted the directory 'important', you can run: 
# extundelete /dev/sda3 --restore-directory user/an/important

Or if you have deleted everything, you can run: 
# extundelete /dev/sda3 --restore-all

0 comments:

Post a Comment