extundelete
ext3/ext4 file recovery utility
TLDR
Restore all deleted files from partition
$ sudo extundelete [/dev/sdXN] --restore-all
Restore a specific file$ extundelete [/dev/sdXN] --restore-file [path/to/file]
Restore a specific directory$ extundelete [/dev/sdXN] --restore-directory [path/to/directory]
Restore files deleted after a date$ extundelete [/dev/sdXN] --restore-all --after [1577840400]
SYNOPSIS
extundelete device [options]
DESCRIPTION
extundelete recovers deleted files from ext3 and ext4 partitions by parsing the filesystem journal. It can restore individual files, directories, or all recoverable files.Works best when run immediately after deletion before journal wraps.
PARAMETERS
--restore-all
Restore all recoverable files--restore-file path
Restore specific file--restore-directory path
Restore specific directory--after time
Only restore files deleted after Unix timestamp--before time
Only restore files deleted before timestamp
INSTALL
sudo apt install extundelete
sudo dnf install extundelete
sudo zypper install extundelete
nix profile install nixpkgs#extundelete
CAVEATS
Only works with ext3/ext4 filesystems. Unmount partition before recovery for best results. Paths are relative to filesystem root (no leading /). Recovery success depends on journal state.