Extundelete

Usage

Syntax

extundelete [options] [--] device-file

Options

--version, -[vV]

Print version and exit successfully.

--help

Print this help and exit successfully.

--superblock

Print contents of superblock in addition to the rest. If no action is specified then this option is implied.

--journal

Show content of journal.

--after dtime

Only process entries deleted on or after 'dtime'.

--before dtime

Only process entries deleted before 'dtime'.

Actions

--inode ino

Show info on inode 'ino'.

--block blk

Show info on block 'blk'.

--restore-inode ino[,ino,...]

Restore the file(s) with known inode number 'ino'. The restored files are created in ./RECOVERED_FILES with their inode number as extension (ie, file.12345).

--restore-file 'path'

Will restore file 'path'. 'path' is relative to root of the partition and does not start with a '/'

The restored file is created in the current directory as 'RECOVERED_FILES/path'.

--restore-files 'path'

Will restore files which are listed in the file 'path'.

Each filename should be in the same format as an option to --restore-file, and there should be one per line.

--restore-directory 'path'

Will restore directory 'path'. 'path' is relative to the root directory of the file system. The restored directory is created in the output directory as 'path'.

--restore-all

Attempts to restore everything.

-j journal

Reads an external journal from the named file.

-b blocknumber

Uses the backup superblock at blocknumber when opening the file system.

-B blocksize

Uses blocksize as the block size when opening the file system. The number should be the number of bytes.

--log 0

Make the program silent.

--log filename

Logs all messages to filename.

--log D1=0,D2=filename

Custom control of log messages with comma-separated

Example

The following example shows how to recover deleted files from a previously mounted LUKS volume

$ sudo apt install extundelete
$ cd /data/tmp/
$ sudo extundelete /dev/mapper/luk_svola --restore-all
$ tree -a RECOVERED_FILES/
RECOVERED_FILES/
└── dir1
    └── secret.txt