Data recovery with extundelete

The extundelete utility allows you to recover files deleted from ext3/ext4 partitions.

The extundelete installation command in Ubuntu:

sudo apt-get install extundelete

Let’s see the name of the section:

sudo fdisk -l

Unmount the partition so as not to permanently damage the data, for example /dev/sdb1:

sudo umount /dev/sdb1

Or make it read-only access to it:

sudo mount -o remount,ro /dev/sdb1

You can make a backup before starting the recovery procedure:

sudo dd if=/dev/sdb1 of=/home/ixnfo/dump.img

Now you can run extundelete (examples with the directory and file that need to be restored):

sudo extundelete /dev/sdb1 --restore-directory /dirname
sudo extundelete /dev/sdb1 --restore-file /dirname/filename

An example of restoring the contents of a deleted directory after a specified time:

sudo extundelete --after DATE /dev/sdb1 --restore-directory /dirname

The time is specified in UNIX format, an example for converting the format:

date -d "Feb 05 2015 12:00" +%s

Official page: extundelete.sourceforge.net

See also my article:
Data recovery with testdisk

Leave a comment

Leave a Reply

Discover more from IT Blog

Subscribe now to keep reading and get access to the full archive.

Continue reading