e2undel

e2undel is a cool tool that helps you recover deleted files on an ext2 file system if you're using Linux. It's like having a backup plan for when things go wrong with your files!

How Does e2undel Work?

This tool comes with a handy library that can help you find and recover deleted files just by their names. You don’t need to be a tech wizard to use it, so anyone can get in on the action!

No Internal Changes Needed

One great thing about e2undel is that it doesn't mess around with the inner workings of the ext2 file system. It only needs read access to where your files are stored, making it super safe. It works by using Ted Ts'o's ext2fs library, so you know it's reliable!

The Recovery Process

The e2undel package includes a library that keeps track of deleted files by name, which is usually lost when you delete something. Once this library is installed, you'll be able to see the names of those deleted files through the e2undel program.

Your Personal File Detective

e2undel checks out all the inodes marked as deleted and sorts them based on who owned them and when they were tossed away. It even tells you the size and tries to guess what type of file it was!

Selecting Files for Recovery

If you've deleted a bunch of stuff, don’t worry! With all that info at your fingertips, you can pick which files you want back. When you've made your choice, e2undel gathers the data from those blocks and saves it into a new file.

The Undel Library: A Must-Have!

The package also comes with an undel library. This little gem tracks deletions made through certain system calls and logs all necessary details like device info and inode numbers into a log file located at /var/e2undel/e2undel.

Requirements for e2undel

• Linux kernel 2.2 or 2.4 (older versions might work too)


• An ext2 filesystem (no ext3 or others)


• This tool has been tested mainly on Intel architecture


• You’ll need glibc version 2.2 or newer.


• The e2fsprogs package should be installed; versions from 1.19 to 1.25 are known to work.


• The e2fsprogs-devel package is also needed.

You compile it using make e2undel-file and install it by copying it anywhere in your $PATH (like /usr/local/bin).

A Little About Deleted Files

If you delete something from an ext2 filesystem, its data isn't gone right away! Here’s what happens:

• The blocks are marked as available.


• The inode gets marked as available too.


• The link count goes down to zero.


• The deletion time gets noted in the inode.


• The filename itself is invalidated in the directory entry.

If you ever need to recover data manually, knowing the inode number