EXT3GREP(8)

✨ NAME ✨

ext3grep — the ext3 file recovery tool, aka the thing you google at 3am after you hit delete and immediately regretted every choice you've ever made 💖

---

🫶 SYNOPSIS 🫶

ext3grep [OPTIONS] FILE ...

---

💜 DESCRIPTION 💜

okay so listen. ext3grep is a simple tool made for literally anyone who accidentally deletes a file on an ext3 filesystem and then, like, five seconds later, realizes they absolutely did want that file. we've all been there bestie. this is the recovery arc. 🦋

---

🎀 OPTIONS 🎀

• --superblock — prints the contents of the superblock in addition to everything else. and if you didn't specify any action at all? then this option is just implied, no need to ask. ✨
• --print — prints the contents of a block or an inode, if there's any to print.
• --ls — prints directories, one line per entry. wanna filter that output? the FILTERS section below has the deets 👇
• --accept FILE — accepts file as a legal filename. you can use this one multiple times, go off. ⚠️ but heads up: if you change any --accept, you must remove BOTH stage* files! both of them. not one. both. 😤
• --journal — prints the contents of the journal.
• --show-path-inodes — shows the inode of every single directory component in paths. the whole trail. 💅

🔍 Filters:

• --group gid — only show/process files owned by process group gid.
• --directory — only show/process process directory inodes.
• --after dtime — only show/process entries deleted on or after dtime.
• --before dtime — only show/process entries deleted before dtime.
• --deleted — only show/process deleted entries.
• --allocated — only show/process allocated inodes/blocks.
• --unallocated — only show/process unallocated inodes/blocks.
• --reallocated — does not suppress entries with reallocated inodes. an inode counts as 'reallocated' when the entry is deleted but the inode is allocated — and also when the file type in the dir entry and the inode are different. two ways to qualify, iconic behavior honestly.
• --zeroed-inodes — does not suppress entries with zeroed inodes. linked entries get shown always, no matter what you do with this option. periodt.
• --depth depth — processes directories recursively, going up till a depth of depth.

⚡ Actions:

• --inode-to-block inode_num — prints the block that contains inode inode_num.
• --inode inode_num — shows info on inode inode_num. if you're also using --ls and the inode is a directory, then the filters apply to the entries of that directory. and if you don't use --ls? then --print is implied. 🤝
• --block block_num — shows info on block block_num. if you're also using --ls and the block is the first block of a directory, then the filters apply to entries of that directory. if you don't use --ls, then --print is implied. same deal as above, bestie.
• --histogram=[atime|ctime|mtime|dtime|group] — generates a histogram based on the given specs. using atime, ctime or mtime will change the meaning of --after and --before to those times. 📊
• --journal-block block_num — shows info on journal block block_num.
• --journal-transaction seq — shows info on the transaction with sequence number seq.
• --dump-names — writes the paths of files to stdout. this implies --ls but suppresses its output. lowkey sneaky, highkey useful.
• --search-start str — finds blocks that start with the fixed string str.
• --search str — finds blocks that contain the fixed string str.
• --search-inode block_num — finds inodes that refer to block block_num.
• --search-zeroed-inodes — returns allocated inode table entries that are zeroed.
• --inode-dirblock-table dir — prints a table for directory path dir of directory block numbers found, and the inodes used for each file. 📋
• --show-journal-inodes inode_num — shows copies of inode inode_num that are still chillin' in the journal.
• --restore-file path — will restore file path. path is relative to the root of the partition and does not start with a / — it has to be one of the paths returned by --dump-names. the restored directory, file or symbolic link gets created in the current directory as ./path. 🫶
• --restore-all — same as --restore-file but it attempts to restore everything. using --after is highly recommended, because trying to restore super old files will only result in them getting hard linked to a more recently deleted file, and that just pollutes the output. messy. don't do that to yourself. 💀
• --show-hardlinks — shows all inodes that are shared by two or more files.
• --version, -[vV] — prints the version information and exits.
• --help — prints a help message and exits.

---

🌈 EXAMPLES 🌈

restoring all the files from the ext3 partition/file /backup/sda1:

ext3grep --restore-all /backup/sda1

listing the files owned by GID 1000 on /backup/sda1:

ext3grep --ls --group 1000 /backup/sda1

finding all files containing the string Critical_report in their name on /backup/sda1:

ext3grep --dump-names /backup/sda1 | grep 'Critical_report'

---

💀 LIMITATIONS 💀

do NOT attempt to use ext3grep for recovery from a mounted filesystem.

Ever.

no, not even then. 😭

ext3grep sometimes runs out of memory spare on 32-bit architectures and crashes. it is highly recommended that you run ext3grep in a 64-bit environment when you're dealing with large filesystems — though this is seen as a bug. 🙈

ext3grep cannot recover files if there are no remnants of them. no remnants, no recovery, that's just how it is bestie. 🧚

some files that ext3grep recovers may have trailing null bytes — just scrape them off like the burnt bits on toast. 🍓

---

🔥 SEE ALSO 🔥

debugfs(8)

---

👑 AUTHOR 👑

ext3grep was written by Carlo Wood <carlo@alinoe.com>.

this manual page was written by Rich Ercolani <rercola@acm.jhu.edu>, for the Debian project (but it may be used by others). it may be distributed under the same terms as ext3grep, the GNU General Public License, either version 2 or (at your option) any later version. ⭐

---

and that's the whole page, bestie — this was version 0.8.0, dated 2008-09-14, and honestly? she ate. 💅✨🦋