https://DevOpsCloud.io -- Cloud Monk Losang Jinpa, Ph.D., MCSE/MCT, GitOps DevOps Engineer

extundelete is an open-source tool designed to recover deleted files from ext3 and ext4 file systems in Linux. It leverages metadata from inodes and the journal to restore files, making it highly effective when data loss occurs on partitions using these file systems. However, recovery success depends on how soon the tool is used after file deletion to avoid overwriting.

—

• **Key Features of extundelete**

   * **Support for ext3 and ext4 File Systems**  
     [[extundelete]] works exclusively on the [[ext3]] and [[ext4]] file systems, taking advantage of journaling to recover recently deleted data.

 * **Metadata-Based Recovery**  
   The tool reads inode metadata and journal logs to identify and recover deleted files.

 * **Selective Recovery**  
   Users can recover individual files or entire directories based on their specific needs.

 * **Partition Recovery**  
   [[extundelete]] can restore all files from a partition, provided no significant data has been overwritten.

 * **Command-Line Interface (CLI)**  
   The tool is lightweight and accessible via the terminal, making it easy to integrate into recovery scripts or system administration tasks.

—

• **How to Use extundelete**

   1. **Install extundelete:**  
      On most [[Linux]] distributions, it can be installed via the package manager:
      ```bash
      sudo apt-get install extundelete
      ```

 2. **Unmount the Affected Partition:**  
    Always unmount the partition before attempting recovery to prevent further changes:
    ```bash
    sudo umount /dev/sdX1
    ```

 3. **Recover a Specific File:**  
    Use the following command to recover a specific file:
    ```bash
    sudo extundelete /dev/sdX1 --restore-file /path/to/file
    ```

 4. **Recover All Deleted Files:**  
    To recover all deleted files from the partition:
    ```bash
    sudo extundelete /dev/sdX1 --restore-all
    ```

 5. **Check Recovered Files:**  
    The restored files will typically be saved in a folder named `RECOVERED_FILES` in the current directory.

—

• **Limitations of extundelete**

   * **Limited to ext3/ext4 File Systems**  
     The tool is incompatible with other file systems like [[XFS]] or [[ZFS]].

 * **Depends on Metadata Integrity**  
   Recovery is only possible if the inode and journal entries are still intact.

 * **No Guarantee for Overwritten Data**  
   Once data has been overwritten, it cannot be recovered by [[extundelete]].

 * **Manual Operation Required**  
   [[extundelete]] is a command-line tool with no graphical interface, which may require familiarity with terminal commands.

—

• **Documentation and GitHub Resources**

   - GitHub Repository: https://github.com/extundelete/extundelete  
   - Official Project Page: https://extundelete.sourceforge.net/

—

extundelete is a powerful and lightweight tool tailored for recovering deleted files from ext3 and ext4 file systems. While it provides reliable results when used promptly, its success heavily depends on the file system's metadata remaining intact. With its selective and full recovery options, extundelete is ideal for system administrators and advanced users managing Linux environments. However, for non-ext file systems, alternative tools will be necessary.