extundelete

extundelete is a tool designed to recover deleted files from ext3 or ext4 partitions. It leverages the information stored in the partition's journal to attempt recovery of deleted files. The tool is particularly useful in forensic scenarios where data recovery is needed from improperly unmounted or damaged filesystems.

Use cases include recovering important files after accidental deletion, forensic investigations requiring retrieval of deleted data, and analysis of ext3/ext4 partitions. The partition should be unmounted to avoid further data loss, and running fsck is recommended if it was improperly unmounted. Warnings are issued about extended attributes not being restored and potential overwriting of deleted files if proceeding without proper preparation.

The tool outputs recovered files to a RECOVERED_FILES directory by default, or a custom directory specified with -o. It provides options for filtering deletions by time and inspecting inodes, blocks, superblocks, and journals.

extundelete uses the information stored in the ext3/ext4 partition's journal to locate and reconstruct deleted files. It loads filesystem metadata and journal descriptors to process deletion entries. Files are restored based on inode numbers or paths relative to the partition root, with output written to a RECOVERED_FILES directory. It handles warnings for features like EXT3_FEATURE_INCOMPAT_RECOVER and does not restore extended attributes.