It is said that only the wearer of the shoe knows where it pinches. Losing data on a hard disk can be frustrating especially if it was an important file that cannot be easily downloaded from the internet. If you decided to call the local data recovery company they can charge to the tune of $70 an hour and who knows how long it will take, not to mention a fixed diagnostic fee. But you only need to recover that word document you had spent months working on. This is where extundelete comes in handy.
Extundelete is a utility to recover deleted files from ext4 and ext3 filesystems. It is an easy to use tool that will help you recover that precious file you deleted accidentally at no cost. It works for ext4 and ext3 filesystems.
To install extundelete download it from the sourceforge page.
After you have downloaded the source code you can now compile it in the following easy steps.
Installing Dependencies
Make sure you have e2fsprogs and e2fslibs libraries installed on your system. Extundelete depends on these libraries and hence must be installed before proceeding.
To install ex2fslibs and e2fsprogs in Fedora:
$ sudo yum install ex2fslibs-devel
$ sudo yum install e2fsprogs
To install ex2fslibs and e2fsprogs in Ubuntu:
$ sudo apt-get install ex2fslibs-devel
$ sudo apt-get install e2fsprogs
Compiling Extundelete
If you have successfully installed the two libraries the next step is to compile the source code.
Unzip the files you downloaded from the sourceforge page.
$ tar -xjf extundelete-0.2.4.tar.bz2
Change directory to the extracted folder as follows.
$ cd ex tundelete-0.2.4
Run the configure script and if by any chances it does not run due to lack permission, make the script executable by
$ chmod u+x configure
$ ./configure
$ make
If you did not encounter any errors, then the executable file is stored in src folder in the extundelete-0.2.4 folder. Now is time to recover those files you deleted accidentally.
Extundelete can be run without installing it in your system. If you find it necessary to install it, run the command, however in this tutorial we will be running it from the current directory.
$ sudo make install
Recovering Data
Stop all processes that are carrying any write operations on the disk you want to recover data from and unmount the disk. You can also mount the disk as read only.
$ umount /dev/sda6
To unmount and remount the disk as read only:
$ mount -o remount,ro /dev/sda6
Either mounting as read only or unmounting will work.
At any one time you get stuck you can use the --help option.
$ src/extundelete --help
Identifying Partition
To restore you need to identify the disk name, for example with the lsblk command.
$ lsblk
Running Extundelete
Depending on the output from lsblk you can see the name of the partitions. Now replace the name of the disk accordingly as in the example below.
$ src/extundelete /dev/sda6 --restore-file home/xuniaw/filename
Note: The filenames are relative to the partition and not the absolute path. That is why they do not start with a '/'.
If you have no idea what was the name of the file but you can recall the directory the file was stored in, then run the command as below. This will list the files in the that directory and indicate if the file is deleted.
$ src/extundelete /dev/sda6 --restore-file home/xuniaw/*
You can now get the filename and use it the previous command.
Now there are circumstances where you have lost all the data on a particular partition and would be interested in recovering all the data.
$ src/extundelete /dev/sda6 --restore-all
Make Program Silent
When restoring all files you might not want all that data thrown to your screen. You can make the program silent using --log 0 action.
$ src/extundelete /dev/sda6 --restore-all --log 0
Output To A Log File
Alternatively if you want to view the output you can Log to file as follows:
$ src/extundelete /dev/sda6 -- restore-all --log logdata.txt
Conclusion
Extundelete is a great program to recover data from a partition. In the case you want to recover data from other disks formatted as FAT or NTFS e.g those precious pictures from your digital camera then you can use PhotoRec or TestDisk.
The post Recover Deleted Data Using extundelete Command in Linux appeared first on LinOxide.