1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
|
.\" Hey, EMACS: -*- nroff -*-
.\" First parameter, NAME, should be all caps
.\" Second parameter, SECTION, should be 1-8, maybe w/ subsection
.\" other parameters are allowed: see man(7), man(1)
.TH EXTUNDELETE 1 "September 29, 2010"
.\" Please adjust this date whenever revising the manpage.
.\"
.\" Some roff macros, for reference:
.\" .nh disable hyphenation
.\" .hy enable hyphenation
.\" .ad l left justify
.\" .ad b justify to both left and right margins
.\" .nf disable filling
.\" .fi enable filling
.\" .br insert line break
.\" .sp <n> insert n+1 empty lines
.\" for manpage-specific macros, see man(7)
.SH NAME
extundelete \- utility to undelete files from an ext3 or ext4 partition.
.SH SYNOPSIS
.B extundelete
.RI [ options ] " device-file" ...
.br
.SH DESCRIPTION
.PP
.\" TeX users may be more comfortable with the \fB<whatever>\fP and
.\" \fI<whatever>\fP escape sequences to invode bold face and italics,
.\" respectively.
\fBextundelete\fP is a utility that can recover deleted files from an ext3 or ext4 partition
.br
extundelete uses the information stored in the partition's journal to attempt to recover
a file that has been deleted from the partition.
.br
There is no guarantee that any particular file will be able to be undeleted, so always try to have
a good backup system in place, or at least put one in place after recovering your files!
.SH OPTIONS
.TP
.B \-\-version
Prints the version number of extundelete.
.TP
.B \-\-help
Print a brief usage summary for extundelete.
.TP
.B Partition name
Name of the partition that has deleted files, such as /dev/sda3.
.br
Could also be the file name of a copy of the partition, such as that made with dd.
.TP
.B \-\-superblock
Prints information about the filesystem from the superblock.
.TP
.B \-\-journal \-\-superblock
Prints information about the journal from the journal's superblock.
.TP
.B \-\-inode #
Prints the information from the inode number of the filesystem given, such as "\-\-inode 2".
.TP
.B \-\-block #
Prints the contents of the block, called as "\-\-block 9652".
.TP
.B \-\-restore\-file path/to/deleted/file
Attempts to restore the file which was deleted at the given filename, called as "\-\-restore-file dirname/filename".
.TP
.B \-\-restore\-inode #
Used to restore inodes by number, called as "\-\-restore-inode 2569".
.br
Also accepts a list of inodes separated by only commas, such as "\-\-restore-inode 2569,5692,6925".
.TP
.B \-\-restore\-files filename
Restores a list of files. First, construct a list of files in the same style as would be
.br
used in the \-\-restore\-file option, and save it to the file "filename".
.br
Then, this option may be used to attempt to restore those files with a single call to extundelete.
.br
This form also reduces redundancy from multiple calls parsing the journal multiple times.
.TP
.B \-\-restore\-all
Restores all files possible to undelete to their names before deletion, when possible.
Other files are restored to a filename like "file.NNNN".
.TP
.B \-\-restore\-directory path/of/directory
Restores all files possible to link to specified directory to their names before deletion, when possible.
.TP
.B \-j journal_dev
Specifies the device that is the external journal of the file system.
.TP
.B \-b block_number
Specifies the block number of the backup superblock to be used when opening the file system.
.TP
.B \-B block_size
Specifies the block size of the partition to be used when opening the file system.
.TP
.B \-\-before date
Only restore files deleted before the date specified, which should be in the form of the number of seconds since the UNIX epoch.
Use a shell command like
.br
$ date \-d "Aug 1 9:02" +%s
.br
to convert a human-readable date to the proper format. The conversion from the number of seconds to a readable format may be found
by using either of the following:
.br
$ date \-d@1234567890
.br
$ perl \-le "print scalar localtime 1234567890"
.TP
.B \-\-after date
Only restore files deleted after the date specified, which should be in the form of the number of seconds since the UNIX epoch.
.br
See the notes for the \-\-before option for more information.
.br
.SH AUTHOR
extundelete was written by Nic Case <number9652@users.sourceforge.net> Copyright (C) 2009, 2012
.PP
This manual page was written by Elías Alejandro Año Mendoza <ealmdz@gmail.com>,
for the Debian project (and may be used by others).
|
