extundelete: An ext3 and ext4 file undeletion utility

About extundelete

extundelete is a utility that can recover deleted files from an ext3 or ext4 partition.<br>The ext3 and ext4 file systems are the most common default file systems in Linux distributions like Mint, Mageia, or Ubuntu.<br>extundelete uses information stored in the partition's journal to attempt to recover a file that has been deleted from the partition.<br>There is no guarantee that any particular file will be able to be undeleted, so always try to have a good backup system in place, or at least put one in place after recovering your files!

Download the latest version

The latest version of extundelete is 0.2.4, which was released in January 2013.<br>Download extundelete from its sourceforge project site.<br>For brief descriptions of the various options the program understands, see the extundelete command-line options summary.<br>Binary packages are available for some distibutions, but may not have the latest version, which could contain improvements to make it more likely to recover a deleted file.<br>To take advantage of the latest features and bug fixes, read the notes on compiling and using the program below.<br>extundelete has been recovering deleted files since April 2009, when the first version was released.

Why use extundelete?

extundelete is a complex program that makes data recovery from an ext3 or ext4 partition simple.<br>Most people are able to recover their files by running one command from the terminal, as explained in the next section.<br>extundelete was the first program able to restore both the contents and the file name of a deleted file on an ext4 partition.<br>ext3grep was the first program to use the filesystem's journal to recover data, and much of its code is shared by extundelete, but ext3grep only worked for ext3 partitions and could take hours to start recovering files if the files were on a large partition.<br>extundelete, by contrast, starts recovering files immediately after parsing the filesystem's journal, usually within a minute or two after starting the program.<br>ext4magic is a program to recover files that was based on extundelete, and has a slightly different set of features and limitations.<br>extundelete makes heavy use of the ext2fs library, which allows it to automatically support many features of ext3 and ext4 file systems.

Documentation

How to compile and install extundelete

To compile and install this program, you must first install the binary and development packages for e2fsprogs (called libext2fs-devel on Mageia, or e2fslibs-dev on Ubuntu, or e2fsprogs-devel on Fedora).<br>extundelete requires libext2fs version 1.39 or newer to run, but for ext4 support, ensure you have e2fsprogs version 1.41 or newer (which may be found by running the command 'dumpe2fs' and noting the version it outputs).<br>You must have g++ and GNU make to compile the program.<br>You can install those with the package called build-essential on Ubuntu, or gcc-c++ and make on Fedora, or gcc-c++ and make on Mageia.

To compile the program, simply enter the command<br>&ldquo;./configure&rdquo; from the directory the tar.bz2 file was extracted to.<br>The configure step ensures all the necessary programs to install and run extundelete have been installed.<br>Then, run &ldquo;make&rdquo; from the same directory to compile the program.<br>The command will generate an executable file called &ldquo;extundelete&rdquo; in the &ldquo;src&rdquo; directory.<br>You can the run &ldquo;make install&rdquo; to install the program in the /usr/bin directory, or it could be run from the &ldquo;src&rdquo; directory without this step.

How to use extundelete

extundelete is designed to undelete files from an unmounted partition to a separate (mounted) partition.<br>extundelete will restore any files it finds to a subdirectory of the current directory named &ldquo;RECOVERED_FILES&rdquo;.<br>To run the program, type &ldquo;extundelete --help&rdquo; to see various options available to you.

Typical usage to restore all deleted files from a partition looks like this:

$ extundelete /dev/sda4 --restore-all

For an example of running the program, see the file &ldquo;README&rdquo; included with the program.<br>It is normal for extundelete to appear to pause (while taking up a lot of cpu cycles) for a minute or longer; during this time, the program is reading the directory structure and looking for a recoverable file within it. To restore important files quickly, you may use the --restore-file, --restore-files, or --restore-directory options.

If you have questions or comments about using extundelete or how to recover your lost files, or to report a success/failure of your recovery efforts with this utility, send a note to the extundelete mailing list.

What to do if you've deleted a file (or multiple files)

Do not save any more data to the partition with the deleted file for any reason! Doing so may overwrite your deleted data and sabotage any recovery effort. Many background processes will periodically write to...