Unix & Linux: undelete a just deleted file on ext4 with extundelete (3 Solutions!!)
Channel: Roel Van de Paar
Date: 08/08/2020

Unix & Linux: undelete a just deleted file on ext4 with extundelete


The Question: Is there a simple option on extundelete how I can try to undelete a file called
/var/tmp/test.iso that I just deleded?
(it is not so important that I would start to remount the drive read-only or
such things. I can also just re-download that file again)
I am looking for a simple command whith that I could try if I manage to fast-
recover it.
I know, it is possible with remounting the drive in read-only: (see https://
unix.stackexchange.com/questions/90186/how-do-i-simply-recover-the-only-file-
on-an-empty-disk-just-deleted?rq=1)
But is this also possible somehow on the still mounted disk?

Solutions: Please watch the whole video to see all solutions, in order of how many people found them helpful

== This solution helped 39 people ==
Looking at the usage guide on http://extundelete.sourceforge.net/ it seems as
though you're limited to undeleting files to a few ways.
**** Restoring all ****
 extundelete is designed to undelete files from an unmounted partition
 to a separate (mounted) partition. extundelete will restore any files
 it finds to a subdirectory of the current directory named
 "RECOVERED_FILES". To run the program, type "extundelete --help" to
 see various options available to you.
 Typical usage to restore all deleted files from a partition looks
 like this:
 $ extundelete /dev/sda4 --restore-all
**** Restoring a single file ****
In addition to this method highlighted in the command line usage:
--restore-file path/to/deleted/file
Attemps to restore the file which was deleted at the given filename,
called as "--restore-file dirname/filename".
So you should be able to accomplish what you want doing this:
$ extundelete --restore-file /var/tmp/test.iso /dev/sda4
NOTE: In both cases you need to know the device, /dev/sda4 to perform this
command. You'll have to remount the filesystem as readonly. This is one of the
conditions of using extundelete and there isn't any way around this.

== This solution helped 19 people ==
Typical usage scenario when undeleting all files includes need to restore all
files deleted from /dev/sdX1 during approximately last hour:
mount -o remount,ro /dev/sdX1
extundelete --restore-all --after $(date -d "-2 hours" +%s) /dev/sdX1
find RECOVERED_FILES/
If satisfied with recovered files:
mount -o remount,rw /dev/sdX1

With thanks & praise to God, and with thanks to the many people who have made this project possible! | Content (except music & images) licensed under cc by-sa 3.0 | Music: https://www.bensound.com/royalty-free-music | Images: https://stocksnap.io/license & others | With thanks to user slm (https://unix.stackexchange.com/users/7453), user sanmai (https://unix.stackexchange.com/users/23316), user rubo77 (https://unix.stackexchange.com/users/20661), user Arnaldo Montoya (https://unix.stackexchange.com/users/248625), and the Stack Exchange Network (http://unix.stackexchange.com/questions/122305). Trademarks are property of their respective owners. Disclaimer: All information is provided "AS IS" without warranty of any kind. You are responsible for your own actions. Please contact me if anything is amiss at Roel D.OT VandePaar A.T gmail.com.