this is obsolete doc -- see http://doc.nethence.com/ instead

Undelete files from an ext3 or ext4 file system 

Introduction 

Midnight Command has a built-in undelete feature but it's designed for ext2. On ext3 and ext4 you have Extundelete (http://extundelete.sourceforge.net/) which will take advantage of journaling. 

Installation 

Download Extundelete compile and install, 

#wget http://sourceforge.net/projects/extundelete/files/latest/download

tar xjf extundelete-0.2.0.tar.bz2

cd extundelete-0.2.0/

./configure

make

make install

Recover files 

Unmount the filesystem, 

umount /dev/vgdata/data

Go to some mount point where you have some free space, as the default dir is ./RECOVERED_FILES/. To restore as much as possible, 

extundelete --restore-all /dev/vgdata/data

or to restore file deleted in the last hour, 

hour=$((60 * 60))

current=`date +%s`

before=$(($current - $hour))

extundelete --after $before --restore-all /dev/vgdata/data

unset hour current before

Ready to go 

See what has been restored, 

ls -al RECOVERED_FILES/