EXTUNDELETE(1)

💖 EXTUNDELETE 💖

okay bestie, grab a strawberry 🍓 and sit down, because we're about to talk about the literal resurrection command. this is the manual for extundelete — the General Commands Manual girlie who brings your deleted files back from the void. no cap. 🦋

✨ NAME ✨

extundelete — a utility to undelete files from an ext3 or ext4 partition. 💅

🌸 SYNOPSIS 🌸

extundelete [options] device-file...

🎀 DESCRIPTION 🎀

extundelete is a utility that can recover deleted files from an ext3 or ext4 partition. periodt.

the way it works is so iconic: extundelete uses the information stored in the partition's journal to attempt to recover a file that has been deleted from the partition. it's giving forensic detective energy. 🔍✨

🫶 but listen, bestie, for real: there is no guarantee that any particular file will be able to be undeleted. so always try to have a good backup system in place, or at least put one in place after recovering your files! 😭 like, don't come for me if it doesn't work, i'm just the messenger.

👑 OPTIONS 👑

• --version — prints the version number of extundelete. cute and simple, she's serving info. 💅
• --help — prints a brief usage summary for extundelete. your little map when you're lost. 🗺️
• Partition name — the name of the partition that has deleted files, such as /dev/sda3. it could also be the file name of a copy of the partition, such as that made with dd. so yes, a dd clone works too, you flexible queen. 🫶
• --superblock — prints information about the filesystem from the superblock. ✨
• --journal --superblock — prints information about the journal from the journal's superblock. the double-flag combo meal, lowkey iconic. 🍔
• --inode # — prints the information from the inode number of the filesystem given, such as --inode 2. 👀
• --block # — prints the contents of the block, called as --block 9652. block party, literally. 🎉
• --restore-file path/to/deleted/file — attempts to restore the file which was deleted at the given filename, called as --restore-file dirname/filename. this is the main character option, ngl. 🌟
• --restore-inode # — used to restore inodes by number, called as --restore-inode 2569. it also accepts a list of inodes separated by only commas, such as --restore-inode 2569,5692,6925. commas only, bestie, no spaces, don't test her. 💀
• --restore-files filename — restores a list of files. first, construct a list of files in the same style as would be used in the --restore-file option, and save it to the file filename. then, this option may be used to attempt to restore those files with a single call to extundelete. this form also reduces redundancy from multiple calls parsing the journal multiple times. efficiency queen fr fr. ⚡
• --restore-all — restores all files possible to undelete to their names before deletion, when possible. other files are restored to a filename like file.NNNN. the "just get everything back" option, we love a maximalist. 🌈
• --restore-directory path/of/directory — restores all files possible to link to specified directory to their names before deletion, when possible. 🧚
• -j journal_dev — specifies the device that is the external journal of the file system. ✨
• -b block_number — specifies the block number of the backup superblock to be used when opening the file system. 🛟
• -B block_size — specifies the block size of the partition to be used when opening the file system. 📏
• --before date — only restore files deleted before the date specified, which should be in the form of the number of seconds since the UNIX epoch. use a shell command like

$ date -d "Aug 1 9:02" +%s

to convert a human-readable date to the proper format. the conversion from the number of seconds to a readable format may be found by using either of the following:

$ date -d@1234567890
$ perl -le "print scalar localtime 1234567890"

math girlies rise up. 🧮💜

• --after date — only restore files deleted after the date specified, which should be in the form of the number of seconds since the UNIX epoch. see the notes for the --before option for more information. she's the mirror twin of --before. 🪞

🌟 AUTHOR 🌟

extundelete was written by Nic Case <number9652@users.sourceforge.net> — Copyright (C) 2009, 2012. 🫶

this manual page was written by Elías Alejandro Año Mendoza <ealmdz@gmail.com>, for the Debian project (and may be used by others). 💖

and that's the whole thing, bestie!! 🎀 this page was born September 29, 2010, and it lives in the EXTUNDELETE(1) corner of the General Commands Manual (Debian edition). now go forth and undelete, you absolute icon. 💅✨🦋