e2undel 0.82

e2undel is an interactive console tool that recovers the data of deleted files on an ext2 file system under Linux.

Included is a library that allows to recover deleted files by name. It does not require any knowledge about the secrets of the ext2 file system and should be useable by everyone.

e2undel does not manipulate internal ext2 structures and requires only read access to the file system where the files to recover are located. It accesses the ext2 file system by way of Ted Tsos ext2fs library; so I think ist is safe to use.

The e2undel package contains a library that allows you to recover deleted files by their names. Usually, when a file is deleted, its name is lost; after installing this library, the names of deleted files are logged and accessible via the e2undel program.

e2undel searches all inodes marked as deleted on a file system and lists them assorted by owner and time of deletion. Additionally, it gives you the file size and tries to determine the file type in the way file(1) does.

If you did not just delete a whole bunch of files with a rm -r *, this information should be helpful to find out which of the deleted files you would like to recover. After selecting a deleted file, e2undel assembles its data by reading the data blocks (whose numbers are still stored in the inode), and writes the data to a new file.

Inluded in the package is the undel library. This library, loaded by the $LD_PRELOAD mechanism, hooks into the system calls unlink(2) and remove(3). libundel logs the device (like /dev/hdb7 etc.), the inode number, and the name of each file that is deleted by these system calls in a log file (/var/e2undel/e2undel by default).

With this information, it is possible to recover deleted files by name. Of course, e2undel also works without the undel library (as outlined in the deleted file recovery howto), but you lose the functionality to recover deleted files by name if you dont use libundel - maybe the best part of this tool.

e2undel does not actually undelete a file (i.e., does not manipulate ext2 internal structures like inode, block bitmap, and inode bitmap). Instead it recovers the data of a deleted file and saves it in a new file.