undelete files on ext4

Question

My mother has placed some important files on her /tmp per accident. Now, of course, they are gone.

This happened yesterday (2 boots of the machine since)

I want to try to undelete the files. They were on /tmp, which was on the same partition as the rest of / , so I need a tool that runs on a mounted system (or maybe I could use a livecd ...)

Right now, I am trying testdisk on a systemrescuecd that I just downloaded. I can get some files from /tmp, but not all. (is it the right tool ? What exactly are those "red" files ? are only some of them recoverable ?)

The best solution is probably a backup and the next best solution for someone who is technically less apt than you perhaps btrfs with frequent snapshots. Packages like restic, rdiff-backup, duplicity or backintime-qt may also be of interest. None of this is going to help you in retrospect, but perhaps this comment helps future visitors. — 0xC0000022L, Jun 17 '20 at 14:41
For me extundelete segments, while testdisk whips out a list of differences. Now to see if it can get the files back. — Vorac, Oct 18 '20 at 10:14

oHo · Answer 1 · 2013-07-09T21:03:51.850

You can also use extundelete

First unmount (umount) the file system where the files have been deleted.
Then read the chapter What to do if you've deleted a file.

You can install extundelete from classic Ubuntu repository:

sudo apt-get install extundelete

Or better, you can download the latest version and compile it:

cd ~/Download
tar -xf extundelete-*.*.*-.tar.bz2  #Replace *.*.* by the version
cd      extundelete-*.*.*
sudo apt-get install e2fslibs-dev   #Required for compilation
./configure
make
sudo make install
extundelete --version               #Should be your *.*.* version

Example of usage: restore all deleted files from directory Images into new created directory restore

sudo extundelete --restore-directory Images/ -o restore /dev/sda3

Bad news if you see your file XXXX within the following format:

Unable to restore inode NNN (Images/XXXX): Space has been reallocated.

See all restored files (look for your file):

find restore -name '*'

Backup your file(s) and remove this temporary directory restore

cp restore/Images/XXXX MY_BACKUP_DIRECTORY
sudo rm -rf restore

This answer has literally just saved my job. Thankyou. – Twifty Aug 01 '17 at 20:14 — Twifty, Aug 01 '17 at 20:14
I get segmentation fault, core dumped. – Onza Jan 19 '22 at 00:20 — Onza, Jan 19 '22 at 00:20

Windigo · Answer 2 · 2012-11-15T19:27:42.243

13

Data recovery, especially on EXT file systems, should be attempted from a live CD or other system that isn't depending on the partition you're undeleting from. Getting the disk unmounted or re-mounted as read only helps a great deal in the recovery effort.

Most of the time I try to create an image of the partition or disk using dd or a similar tool, so that I'm not working on the disk itself:

dd if=/dev/sd[xx] of=/media/backup_drive/recovery.img

Once you have your image, you can use a tool like ext3grep to try and find the files you're looking for. There are lots of different switches that you can try, but this might be a good start:

ext3grep --restore-file 'tmp/moms-file.txt' recovery.img

The ext3grep utility also provides several different ways to search through the file system if you don't know the name of the file. Check ext3grep --help for the various methods of searching.

edited Nov 15 '12 at 19:27

answered Nov 15 '12 at 14:57

Windigo

1,167

It would be nice, if you could add the exact steps? – saji89 Nov 15 '12 at 15:20
@saji89 Added a sample usage - also fixed to link to the right utility! – Windigo Nov 15 '12 at 19:28
nice.
now ... does it work with ext4 ?
– josinalvo Nov 16 '12 at 15:11
2

@josinalvo I was working with an EXT4 volume when I tried it, and it did work; it didn't find the files I was looking for, but I think I had missed the window of opportunity. – Windigo Nov 21 '12 at 16:16

score 10 · Answer 3 · edited Aug 21 '20 at 15:34

10

I prefered to use ext4magic as :

sudo ext4magic  /dev/sdc3 -r -f $USERl/Documents/ -d /tmp/local/tmp/

Note you have to resolv symlink by your own

References:

http://ext4magic.sourceforge.net/howto_en.html

http://sourceforge.net/projects/ext4magic/

http://rzr.online.fr/q/recover

edited Aug 21 '20 at 15:34

N0rbert

99,918

answered Apr 13 '15 at 09:01

rzr

415

score 1 · Answer 4 · edited Aug 26 '18 at 19:45

1

AnalyzeEXT

Parse data blocks for EXT directory data.

Detailed documentation on EXT4 can be found here:

Download the perl script with

git clone https://github.com/halpomeranz/analyzeEXT

No guarantee but may be able to reconstruct deleted filesystems.

edited Aug 26 '18 at 19:45

abu_bua

10,783

answered Aug 26 '18 at 18:23

jouell

299

1

What is this tool exactly? How do you use it? I've read the repo description and the help message in the script, but there's not much detail. – wjandrea Aug 26 '18 at 18:42
Took a look at the perl script; the cli help doesn't match with the script! – abu_bua Aug 26 '18 at 20:17
More details are here. I stumbled up on it - never used it! https://www.youtube.com/watch?v=6pzm6909IvY – jouell Aug 27 '18 at 00:42
@jouell I've watched 2:30 of the video and he hasn't mentioned the script yet. Could you [edit] your answer to add a brief summary? – wjandrea Aug 27 '18 at 04:46

Ivan Tsukev · Answer 5 · 2018-08-08T16:06:54.263

I could not recover my crontab file by using ext4magic or extundelete.

On Debian, the crontab for root is here:

/var/spool/cron/crontabs/root

But, by using the following command, I was able to at least manually recover my crontab from the logs.

 grep CRON /var/log/syslog.* -i| awk -F " CMD " {'print $2;'} |sort | uniq

It will output only the executed cron jobs (no timings), but at least this is a lot more than starting from scratch.

If you don't remember how often certain cron jobs run, take a full log e.g. syslog.1 and this will give you the count for runs trough the day:

grep CRON /var/log/syslog.1 -i| awk -F " CMD " {'print $2;'} |sort | uniq -c |sort -n

undelete files on ext4

5 Answers5

AnalyzeEXT

Linked

Related