Linux Undelete
If all of the following conditions applies to your situation then this is the correct resource:
- You deleted a file or directory by accident or otherwise and you wish to have it back again.
- You wish it to be a simple process that can be accomplished without rebooting or using other boot media. You are looking for something as straightforward as the Windows Recycling Bin, except on linux.
- You are running Ubuntu, Mint, or equivalent.
If not, then please view the RELATED section for other situations.
The deletion of files in ext3/4 filesystems can not be easily reversed. However the ext4 file system has a feature called journalling.
If you want to see if the journal exists then determine the partition (you can use blkid) and then use dumpe2fs. In this example our ext4 fs is sda2 because our EFI partition is sda1. So the command:
sudo dumpe2fs /dev/sda2 | grep -i journal
The exact contents of the journal depend on how you have configured your ext4 file system. Most people choose installation defaults. There's a packet in debian called sleuthkit, in which you have some tools like jls or jcat. The jls tool can list all journal entries of an ext4 file system. There's also debugfs in e2fsprogs package. It has logdump tool, which is similar to the jls.
File Manager
The file manager, example N=emo or PCManFM, has the equivalent to a rubbish bin or recovery directory
- Open Nemo (file manager) click on Trash in left column and see if it's in there.
Files or directories deleted other ways, such as by software like qBittorrent bypass the rubbish bin or equivalent.
testdisk
This utility is useless for file recovery despite all the air headed guides that appear in an Internet search. The limitation is in the file systems that testdisk supports for file recovery. For example on a contemporary Mint Linux installation with default install options the file system type is not supported for undelete file recovery.
Use the following command
blkid
If you see that you are using TYPE="ext4" then forget about testdisk recovering your deleted file or directory.
extundelete
This flaming turd can not undelete or otherwise recover a file or directory on a mounted partition. Since basic default Ubuntu or Mint installations done by ordinary users tend to have the root and home partition along with most everything else on the same partition, it can not be unmounted while the system is booted unless you boot to independent boot media or other partition.
ext4magic
Also requires you unmount the whole bloody filesystem just to recover a single file! This utility takes advantage of the filesystem journal of ext4. it is often possible, to restore sufficient information for a recover of many data files, directly from the filesystem Journal. ext4magic can extract the information from the Journal, and can restore files in entire directory trees, provided that the information in the Journal are sufficient. This tool can recover the most file types, can recover large and sparse files, recovered files with orginal filename, with the orginal owner an group, the orginal file mode bits, and also the old atime/mtime stamp.
This "seems" to do bulk recovery and require you to unmount the file system.
R-Linux
This is not FOSS. It is commercial however claims to be free to use.
