Extundelete, recover deleted files.

ACE2x500y500

A few weeks ago I was reading a Article of Elav on backups and it fell like a glove, as I was recovering from the accidental loss of my / home.

A victim of sleep and stress, I made a mistake and my data was deleted, I went into panic and despair. After assimilating it I remembered a tool called Get out.

extundelete is an excellent tool, which allows you to recover deleted data on ext3 and ext4 partitions.

Some of its characteristics:

Ability to preserve the original name of the recovered files, it can recover partitions, directories and subdirectories, among others.

Let's go to what interests us.

When accidentally deleting a file, directory or partition, you should immediately shut down your computer or unmount the partition.

This to prevent new data from being written to the physical space of the disk, if this happens, the possibility of recovery decreases.

If possible, start from a Live CD or USB of your favorite distribution and install Extundelete.

To install on Debian and derivatives:

sudo apt-get install extundelete

Next we mount the partition where our files were located, in read mode (suppose that the sda4 partition is our home).

sudo mount -o remount,ro /dev/sda4

If we want to restore the entire partition:

sudo extundelete /dev/sda4 --restore-all

If we want to restore a specific directory (for example the folder "documents"):

sudo extundelete /dev/sda4 --restore-directory /home/tu_usuario/documentos

If we want to restore a specific file (for example the video gato.flv):

sudo extundelete /dev/sda4 --restore-file /home/tu_usuario/videos/gato.flv

The recovered files will be saved in a directory called RECOVERED_FILES.
Remember to have enough space available on the partition where your files will be restored (by default in the folder where you are located on the console).

If you do not know the name of the partitions that interest you, write in the console:

df -h

o

sudo fdisk -l

extundelete It has a large number of options that you can explore on its page, but with the above, you are sure to get out of trouble. I was able to recover maybe 90% - 95% of my partition.


The content of the article adheres to our principles of editorial ethics. To report an error click here!.

21 comments, leave yours

Leave a Comment

Your email address will not be published. Required fields are marked with *

*

*

  1. Responsible for the data: Miguel Ángel Gatón
  2. Purpose of the data: Control SPAM, comment management.
  3. Legitimation: Your consent
  4. Communication of the data: The data will not be communicated to third parties except by legal obligation.
  5. Data storage: Database hosted by Occentus Networks (EU)
  6. Rights: At any time you can limit, recover and delete your information.

  1.   KZKG ^ Gaara said

    Oh interesting, I already knew testdisk or photorec but do not extundelete, I hope I never have to use it ... I hope I have not deleted something and then regret it 😀

    Thanks for the post

    1.    Citux said

      For nothing KZKG ^ Gaara, nice to meet 🙂

    2.    Joaquin said

      Yes, I also knew these two. But if I'm not mistaken they are used more when the partition table is broken or not?

  2.   meiganova said

    Well, I don't need it right now but I've installed it just in case, I'll try to delete something to see how it works. I find it very interesting.

    1.    Citux said

      It doesn't hurt to remind you to be careful when deleting something 🙂. Regards.

  3.   ENRIQUE said

    Hi. Good morning, it sounds interesting but I see that it only applies to ext1 partitions. what is there for ntfs or fat .. slds.

    1.    Citux said

      Actually this tool is focused on ext3 and ext4. But for ntfs and others there are quite a few tools that I hope I can talk about.

  4.   ENRIQUE said

    hello, very interesting but only applies to ext3 and 4. what do you have for fat and ntfs? slds.

    1.    Citux said

      Hi, you can use PhotoRec, it supports FAT, NTFS, exFAT, ext2 / ext3 / ext4, HFS +.

  5.   Shupacabra said

    What we urgently need is a recuperator with a graphical interface, new users with the console do not get along, it is a good piece of information and it is appreciated, but graphical interfaces are missing =) Kind regards

    1.    Citux said

      Quite true, although it is a good pretext to begin to be interested in the blessed console. Regards.

  6.   eliotime3000 said

    And as an animal I am trying to do it on Windows partitions with RecoverMyFiles.

    Anyway, I hope they improve it to be able to be used in NTFS partitions and thus avoid paying (and / or using warez) for proprietary software.

    Good post.

  7.   Joaquin said

    Good input, thank you!

  8.   vidagnu said

    Excellent, I just add that when you recover the files it saves them in a folder called RECOVERED_FILES in the current folder from where extundelete was run.

    regards

  9.   Ivan said

    Here you have a list of multiplatform and free tools for recovering deleted files. It also shows the 5 questions to ask yourself before trying to recover files so as not to waste time http://cursohacker.es/recuperar-archivos-borrados-programas

    Greetings.

  10.   Paschal said

    Very useful article. 🙂
    Do you know if there is something similar for BTRFS?

    Greetings.

  11.   Lorraine said

    Hello:

    To recover deleted photos, which is the best?

    Thank you

  12.   Diego said

    This utility is great, it worked 95%. Better than others there are, you just have to add the –output-dir option to the command so that they are restored to another hard disk and not overwrite files that were not recovered, so we can pass another utility to check the disk. Thanks for sharing.

  13.   Marcelo Lane said

    Thank you. Very useful, I almost completely recovered the directory «Desktop» (which I surely accidentally deleted because it just appeared empty) from my / home folder, I used KaliLinux

  14.   GENDA said

    I have a problem, apparently it cannot retrieve a file or directory that has a space in its entire address, for example, Home / user / music / DISK 1, I don't know ... it throws an error for me.

  15.   danteis said

    Hello, thanks for the information, very useful especially because, if one is going to retrieve information, it is more for urgency. One question, in the process of recovering the entire partition, says that first you have to unmount the partition, for example, if it is in the / home folder (Debian-Ubuntu) that you have it as a partition, how could you unmount and continue with the process, would you play via root? Is it possible that when restarting some information it will be lost if it is expected to recover at the same time as it is erased?