Recover Deleted Data Using extundelete Command in Linux

It is said that only the wearer of the shoe knows where it pinches. Losing data on a hard disk can be frustrating especially if it was an important file that cannot be easily downloaded from the internet. If you decided to call the local data recovery company they can charge to the tune of $70 an hour and who knows how long it will take, not to mention a fixed diagnostic fee. But you only need to recover that word document you had spent months working on. This is where extundelete comes in handy.

Extundelete is a utility to recover deleted files from ext4 and ext3 filesystems. It is an easy to use tool that will help you recover that precious file you deleted accidentally at no cost. It works for ext4 and ext3 filesystems.

To install extundelete download it from the sourceforge page.

After you have downloaded the source code you can now compile it in the following easy steps.

Installing Dependencies

Make sure you have e2fsprogs and e2fslibs libraries installed on your system. Extundelete depends on these libraries and hence must be installed before proceeding.

To install ex2fslibs and e2fsprogs in Fedora:

$ sudo yum install ex2fslibs-devel

$ sudo yum install e2fsprogs

To install ex2fslibs and e2fsprogs in Ubuntu:

$ sudo apt-get install ex2fslibs-devel
$ sudo apt-get install e2fsprogs

Compiling Extundelete

If you have successfully installed the two libraries the next step is to compile the source code.

Unzip the files you downloaded from the sourceforge page.

$ tar -xjf extundelete-0.2.4.tar.bz2

Change directory to the extracted folder as follows.

$ cd ex tundelete-0.2.4

Run the configure script and if by any chances it does not run due to lack permission, make the script executable by

$ chmod u+x configure
$ ./configure
$ make

If you did not encounter any errors, then the executable file is stored in src folder in the extundelete-0.2.4 folder. Now is time to recover those files you deleted accidentally.

Extundelete can be run without installing it in your system. If you find it necessary to install it, run the command, however in this tutorial we will be running it from the current directory.

$ sudo make instal

Recovering Data

Stop all processes that are carrying any write operations on the disk you want to recover data from and unmount the disk. You can also mount the disk as read only.

$ umount /dev/sda6

To unmount and remount the disk as read only:

$ mount -o remount,ro /dev/sda6

Either mounting as read only or unmounting will work.

At any one time you get stuck you can use the --help option.

$ src/extundelete --help

Identifying Partition

To restore you need to identify the disk name, for example with the lsblk command.

$ lsblk

Running Extundelete

Depending on the output from lsblk you can see the name of the partitions. Now replace the name of the disk accordingly as in the example below.

$ src/extundelete /dev/sda6 --restore-file home/xuniaw/filename

recovering data
Note: The filenames are relative to the partition and not the absolute path. That is why they do not start with a '/'.

If you have no idea what was the name of the file but you can recall the directory the file was stored in, then run the command as below. This will list the files in the that directory and indicate if the file is deleted.

$ src/extundelete /dev/sda6 --restore-file home/xuniaw/*

You can now get the filename and use it the previous command.

Now there are circumstances where you have lost all the data on a particular partition and would be interested in recovering all the data.

$ src/extundelete /dev/sda6 --restore-all

Make Program Silent

When restoring all files you might not want all that data thrown to your screen. You can make the program silent using --log 0 action.

$ src/extundelete /dev/sda6 --restore-all --log 0

Output To A Log File

Alternatively if you want to view the output you can Log to file as follows:

$ src/extundelete /dev/sda6 -- restore-all --log logdata.txt


Extundelete is a great program to recover data from a partition. In the case you want to recover data from other disks formatted as FAT or NTFS e.g those precious pictures from your digital camera then you can use PhotoRec or TestDisk.

2 Comments... add one

  1. oot@web:~/test# extundelete /dev/md3 --restore-directory 15.04.26
    WARNING: Extended attributes are not restored.
    Loading filesystem metadata ... 4219 groups loaded.
    Loading journal descriptors ... 32589 descriptors loaded.
    Searching for recoverable inodes in directory 15.04.26 ...
    2076 recoverable inodes found.
    Looking through the directory structure for deleted files ...
    2076 recoverable inodes still lost.
    No files were undeleted

    How i can recovery folder 15.04.26 and file?


Leave a Comment