Undelete File on ext4 with extundelete – Recover Deleted Files on ext4

data-recoverydeleted-filesextundeletefiles

Is there a simple option on extundelete how I can try to undelete a file called /var/tmp/test.iso that I just deleted?

(it is not so important that I would start to remount the drive read-only or such things. I can also just re-download that file again)

I am looking for a simple command with that I could try if I manage to fast-recover it.

I know, it is possible with remounting the drive in read-only: (see How do I simply recover the only file on an empty disk just deleted?)

But is this also possible somehow on the still mounted disk?

For info:
if the deleted file is on an NTFS partition it is easy with ntfsundelete e.g. if you know the size was about 250MB use

sudo ntfsundelete -S 240m-260m -p 100 /dev/hda2

and then undelete the file by inode e.g. with

sudo ntfsundelete /dev/hda2 --undelete --inodes 8270

Best Answer

Looking at the usage guide on extundelete it seems as though you're limited to undeleting files to a few ways.

Restoring all

extundelete is designed to undelete files from an unmounted partition to a separate (mounted) partition. extundelete will restore any files it finds to a subdirectory of the current directory named “RECOVERED_FILES”. To run the program, type “extundelete --help” to see various options available to you.

Typical usage to restore all deleted files from a partition looks like this:
    $ extundelete /dev/sda4 --restore-all

Restoring a single file

In addition to this method highlighted in the command line usage:

--restore-file path/to/deleted/file
    Attemps to restore the file which was deleted at the given filename, 
    called as "--restore-file dirname/filename".

So you should be able to accomplish what you want doing this:

$ extundelete --restore-file /var/tmp/test.iso /dev/sda4

NOTE: In both cases you need to know the device, /dev/sda4 to perform this command. You'll have to remount the filesystem as readonly. This is one of the conditions of using extundelete and there isn't any way around this.

Related Solutions

Recover just deleted scanned pdf without unmounting

If you can scan the document again, you might be able to automatically compare that against the recovered documents. But if that is the case you probably don't need to recover.

That leaves finding the right PDF, and since opening them one by one in programs like evince is cumbersome I recommend you run the following in the directory where the .pdf files are recovered:

for i in *.pdf ; do
  pdfimages -j -l 1 "$i" "${i%}"
done

This will leave with JPEG files (-j option, unless the scanned file was not JPEG, which is unlikely) with the first page ( -l 1 ) with same basename as your PDFs.

Now you can use eog to quickly browse through the extracted images until you (visually) recognise the document you are looking for. Once found the image file will have the same basename as the PDF file you are looking for.

Recover formatted ext4 partition with file structure

The forensic tools the recovery company will use could include EnCase Forensic, which is probably the leading forensic data recovery utility. EnCase takes the drive image recovers the raw data, then makes pretty intelligent assumptions as to what blocks form what files.

There are still limitations, so an element of this is likely to be manually processed.

On a Windows machine you'd likely have a copy of your Master File Table. Sadly, under ext4 this doesn't exist, but you can make reasonable assumptions based on inode timestamps and other metadata.