extundelete, Recover deleted files in Ubuntu

Download and make extundelete

Run this script to download and compile extundelete from source

#remove the installed 
sudo apt-get remove extundelete

# we are are going to build it from source
# install apps
sudo apt-get -y install build-essential e2fslibs-dev

# download
cd /tmp
wget http://downloads.sourceforge.net/project/extundelete/extundelete/0.2.4/extundelete-0.2.4.tar.bz2

# extract
tar xjf /tmp/extundelete-0.2.4.tar.bz2 -C 

# compile
cd extundelete-0.2.4
./configure
make

Recover Files

Get drive name

Now that the extundelete is compiled, you would need to check the name of the drive to recover. And that can done by:

sudo fdisk -l

Restore

Restore all
 
# restore files 
cd /tmp src/extundelete /dev/sdc1 --restore-all 
#if you want to restore a folder "/home/images" 
Restore a directory
cd /tmp 
src/extundelete --restore-directory /home/images /dev/sdc1 
Restore a directory after a date/time

In case you want to recover files after a particular date/time, you can do it with –after option

#first find the epoch of the time after which you want to restore, i would restore after 2 Jan
date -d "Jan 2 10:00" +%s
# output is 1483347600

# then i input the epoch time into the extundelete command as below
sudo src/extundelete /dev/sdc1 --restore-directory /home/images --after 1483347600

In the RECOVERY_FILES directory you will find the recovered files

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.