Is there a simple option on
extundelete how I can try to undelete a file called
/var/tmp/test.iso that I just deleted?
(it is not so important that I would start to remount the drive read-only or such things. I can also just re-download that file again)
I am looking for a simple command with that I could try if I manage to fast-recover it.
I know, it is possible with remounting the drive in read-only: (see How do I simply recover the only file on an empty disk just deleted?)
But is this also possible somehow on the still mounted disk?
if the deleted file is on an NTFS partition it is easy with
ntfsundelete e.g. if you know the size was about 250MB use
sudo ntfsundelete -S 240m-260m -p 100 /dev/hda2
and then undelete the file by inode e.g. with
sudo ntfsundelete /dev/hda2 --undelete --inodes 8270