Difference between revisions of "Linux Undelete"

Revision as of 12:47, 27 July 2023

If all of the following conditions applies to your situation then this is the correct resource:

1. You deleted a file or directory by accident or otherwise and you wish to have it back again.
2. You wish it to be a simple process that can be accomplished without rebooting or using other boot media. You are looking for something as straightforward as the Windows Recycling Bin, except on linux.
3. You are running Ubuntu, Mint, or equivalent.

If not, then please view the RELATED section for other situations.

The deletion of files in ext3/4 filesystems can not be easily reversed. However the ext4 file system has a feature called journalling.

If you want to see if the journal exists then determine the partition (you can use blkid) and then use dumpe2fs. In this example our ext4 fs is sda2 because our EFI partition is sda1. So the command:

sudo dumpe2fs /dev/sda2 | grep -i journal

The exact contents of the journal depend on how you have configured your ext4 file system. Most people choose installation defaults. There's a packet in debian called sleuthkit, in which you have some tools like jls or jcat. The jls tool can list all journal entries of an ext4 file system. There's also debugfs in e2fsprogs package. It has logdump tool, which is similar to the jls.

File Manager

The file manager, example N=emo or PCManFM, has the equivalent to a rubbish bin or recovery directory

• Open Nemo (file manager) click on Trash in left column and see if it's in there.

Files or directories deleted other ways, such as by software like qBittorrent bypass the rubbish bin or equivalent.

testdisk

This utility is useless for file recovery despite all the air headed guides that appear in an Internet search. The limitation is in the file systems that testdisk supports for file recovery. For example on a contemporary Mint Linux installation with default install options the file system type is not supported for undelete file recovery.

Use the following command

blkid

If you see that you are using TYPE="ext4" then forget about testdisk recovering your deleted file or directory.

extundelete

This flaming turd can not undelete or otherwise recover a file or directory on a mounted partition. Since basic default Ubuntu or Mint installations done by ordinary users tend to have the root and home partition along with most everything else on the same partition, it can not be unmounted while the system is booted unless you boot to independent boot media or other partition.

ext4magic

Also requires you unmount the whole bloody filesystem just to recover a single file! This utility takes advantage of the filesystem journal of ext4. it is often possible, to restore sufficient information for a recover of many data files, directly from the filesystem Journal. ext4magic can extract the information from the Journal, and can restore files in entire directory trees, provided that the information in the Journal are sufficient. This tool can recover the most file types, can recover large and sparse files, recovered files with orginal filename, with the orginal owner an group, the orginal file mode bits, and also the old atime/mtime stamp.

This "seems" to do bulk recovery and require you to unmount the file system.

Ref: The direct use of the journal one a read-write mounted file system produces ext4magic errors and wrong results - A file system should before the use with ext4magic first umounted or mount it read-only. In some cases this will not be possible, and also the loss of only one file will not always justify this expenditure really. ext4magic has an evasion of this problem, which is classified however at present still as experimental for unique smaller actions.

R-Linux

This is not FOSS. It is commercial however claims to be free to use.

We'll be testing R-Linux for Debian/Ubuntu Linux platform (64-bit) RLinux6_x64.deb Download Size: 66.41 MB Date Released: Apr 18 2023 Version: 6.2 build 191150 available on the Download R-Linux for Linux page of their web site. The downloaded file is a DEB package "RLinux6_x64.deb" that can be installed easily via.

It seems to install to "/usr/local/R-Linux" and create a launcher.

Related

• Disk Data Recovery
• Data Recovery From a Failing Hard Drive
• CD/DVD Scratch Repair
• Linux Mount Hibernated Windows Partitions
• Linux Undelete