51

Is there a simple option on extundelete how I can try to undelete a file called /var/tmp/test.iso that I just deleded?

(it is not so important that I would start to remount the drive read-only or such things. I can also just re-download that file again)

I am looking for a simple command whith that I could try if I manage to fast-recover it.

I know, it is possible with remounting the drive in read-only: (see How do I simply recover the only file on an empty disk just deleted?)

But is this also possible somehow on the still mounted disk?

35

Looking at the usage guide on extundelete it seems as though you're limited to undeleting files to a few ways.

Restoring all

extundelete is designed to undelete files from an unmounted partition to a separate (mounted) partition. extundelete will restore any files it finds to a subdirectory of the current directory named “RECOVERED_FILES”. To run the program, type “extundelete --help” to see various options available to you.

Typical usage to restore all deleted files from a partition looks like this:

    $ extundelete /dev/sda4 --restore-all

Restoring a single file

In addition to this method highlighted in the command line usage:

--restore-file path/to/deleted/file
    Attemps to restore the file which was deleted at the given filename, 
    called as "--restore-file dirname/filename".

So you should be able to accomplish what you want doing this:

$ extundelete --restore-file /var/tmp/test.iso /dev/sda4

NOTE: In both cases you need to know the device, /dev/sda4 to perform this command. You'll have to remount the filesystem as readonly. This is one of the conditions of using extundelete and there isn't any way around this.

  • 2
    yes, but that all only works, if I remount the drive read-only – rubo77 Mar 31 '14 at 0:14
  • 1
    @rubo77 - correct, there isn't any way around that. – slm Mar 31 '14 at 0:20
  • 2
    This actually worked for me an an ext4 filesystem without remounting it read-only. If you try to do it without remounting r/o, then you get a warning which just seems to be telling you that your probability of success is lower if you do that. If it's really super vital to recover the file, then it sounds like you should do that. – Ben Crowell Aug 25 '14 at 23:53
  • Like @BenCrowell I've used without remount, but program adverts me about data corruption if I continue using hdd... was a recently erase so I just press Enter then get my files back ;) – erm3nda Jan 11 '16 at 23:27
15

Typical usage scenario when undeleting all files includes need to restore all files deleted from /dev/sdX1 during approximately last hour:

mount -o remount,ro /dev/sdX1
extundelete --restore-all --after $(date -d "-2 hours" +%s) /dev/sdX1
find RECOVERED_FILES/

If satisfied with recovered files:

mount -o remount,rw /dev/sdX1
  • mount: you must specify the filesystem type – user91679 Jan 27 '16 at 13:19
  • remount expects mount point as argument not the device – Don't You Worry Child Jul 21 '16 at 11:26
  • @Don'tYouWorryChild mount -o takes either dir or device, as per man mount – sanmai Jul 22 '16 at 12:28
  • Instead of subtracting 2 hours from date you can do $(date -d "-2 hours" +%s) and the output of lsblk -p may be useful to find where that LUKS encrypted LVM cached EXT4 volume is located. ;) – LiveWireBT Dec 25 '16 at 18:19
2

Unix isn't DOS. You can't make arbitrary modifications to filesystem data on read-write mounted partitions.

This is a Good Thing.

extundelete is a utility that can recover deleted files from an ext3 or ext4 partition. The ext3 and ext4 file systems are the most common default file systems in Linux distributions like Mint, Mageia, or Ubuntu. extundelete uses information stored in the partition's journal to attempt to recover a file that has been deleted from the partition. There is no guarantee that any particular file will be able to be undeleted, so always try to have a good backup system in place, or at least put one in place after recovering your files!

  • I used it recently. I decided to use it on a mounted file system. It recovered a lot of files but some had names changed or content was from another file - same effect. Afterwards I realised that I should have directed files to a recovery directory on another file system or, cd to some folder on another file system first. – philcolbourn Oct 14 '18 at 3:04
  • eg. cd /media/XXXX/tmp # work from another file system then sudo extundelete --restore-directory /phil/Development/<deleted directory> /dev/sda13 – philcolbourn Oct 14 '18 at 5:06
  • i just want to point out the irony of this comment - precisely in UNIX you can, as root, pretty much do anything whatever you please. Your answer is inaccurate, because the reason isn't that you can't make arbitrary modifications (you can), but that no one has bothered to change the tool to work on online file systems. – Aaa Mar 6 at 16:48

protected by Community Jun 23 '17 at 1:11

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.