Restore files on ext3/ext4 filesytem
Due to my own stupidity I accidently deleted a file on my ext4 filesystem, googling for an answer I found extundelete.
What follows is a quick howto (which I hope is complete) for the installation under Ubuntu 11.04 (Debian derative). It worked in so far that it restored a recently deleted text file amongst all the other deleted files (make sure you have enough diskspace).
Installation
Download extundelete from: http://extundelete.sourceforge.net/
Dependencies under Ubuntu (gcc,make etc. and e2fslibs-dev)
- apt-get install build-essential
- apt-get install e2fslibs-dev
# tar xvjf extundelete-0.2.0.tar.bz2
# cd extundelete-0.2.0
# ./configure && make && make install
# umount <filesystem>
Preparation
After the installation make sure the filesystem (ext3/ext4) is not mounted. This example is for a ext4 filesystem:
# umount < mountpoint filesystem>
(if you’re in a hurry: umount -l <mountpoint filesystem>
Check the filesystem for errors:
# fsck.ext4 /dev/xxx
Go to a mounted filesystem with enough diskspace (estimated)for the output (df -h)
Running extundelete
Restore deleted files with:
# extundelete /dev/xxx –journal –restore-all
You can probably do this more precise. With this command it dumps everything in a new directory called RECOVERED_FILES. After a while you will see files popping up like black magic in this directory. You can access the restored file structure and files and what not (e.g for /home : Documents, Pictures, Downloads etc.) and hopefully you’ll find the file(s) you were looking for still in a proper shape.