this is obsolete doc -- see instead

Undelete files from an ext3 or ext4 file system 



Midnight Command has a built-in undelete feature but it's designed for ext2. On ext3 and ext4 you have Extundelete ( which will take advantage of journaling. 



Download Extundelete compile and install, 

tar xjf extundelete-0.2.0.tar.bz2
cd extundelete-0.2.0/
make install


Recover files 

Unmount the filesystem, 

umount /dev/vgdata/data


Go to some mount point where you have some free space, as the default dir is ./RECOVERED_FILES/. To restore as much as possible, 

extundelete --restore-all /dev/vgdata/data

or to restore file deleted in the last hour, 

hour=$((60 * 60))
current=`date +%s`
before=$(($current - $hour))
extundelete --after $before --restore-all /dev/vgdata/data
unset hour current before


Ready to go 

See what has been restored,