From aldeid
Jump to navigation Jump to search




extundelete [options] [--] device-file


--version, -[vV]
Print version and exit successfully.
Print this help and exit successfully.
Print contents of superblock in addition to the rest. If no action is specified then this option is implied.
Show content of journal.
--after dtime
Only process entries deleted on or after 'dtime'.
--before dtime
Only process entries deleted before 'dtime'.


--inode ino
Show info on inode 'ino'.
--block blk
Show info on block 'blk'.
--restore-inode ino[,ino,...]
Restore the file(s) with known inode number 'ino'. The restored files are created in ./RECOVERED_FILES with their inode number as extension (ie, file.12345).
--restore-file 'path'
Will restore file 'path'. 'path' is relative to root of the partition and does not start with a '/'
The restored file is created in the current directory as 'RECOVERED_FILES/path'.
--restore-files 'path'
Will restore files which are listed in the file 'path'.
Each filename should be in the same format as an option to --restore-file, and there should be one per line.
--restore-directory 'path'
Will restore directory 'path'. 'path' is relative to the root directory of the file system. The restored directory is created in the output directory as 'path'.
Attempts to restore everything.
-j journal
Reads an external journal from the named file.
-b blocknumber
Uses the backup superblock at blocknumber when opening the file system.
-B blocksize
Uses blocksize as the block size when opening the file system. The number should be the number of bytes.
--log 0
Make the program silent.
--log filename
Logs all messages to filename.
--log D1=0,D2=filename
Custom control of log messages with comma-separated


The following example shows how to recover deleted files from a previously mounted LUKS volume

$ sudo apt install extundelete
$ cd /data/tmp/
$ sudo extundelete /dev/mapper/luk_svola --restore-all
└── dir1
    └── secret.txt