E2undel is a Linux software tool that enables file recovery for the ext2 file system. Its primary function is to undelete files that have been accidentally deleted.
e2undel is a powerful console tool that allows users to recover deleted files on an ext2 file system under Linux. With the inclusion of a library that enables the recovery of deleted files by name, e2undel is easy to use for everyone, even without prior knowledge of the ext2 file system. Additionally, e2undel does not manipulate internal ext2 structures and only requires read access to the file system where the files to recover are located.
Access to the ext2 file system is done by way of Ted Ts'o's well-known ext2fs library, ensuring safety in application. Notably, the e2undel package includes a library that enables one to recover deleted files by their names. After installation, e2undel logs the names of all deleted files, making them accessible via the program. The tool then searches for all inodes marked as deleted on a file system, listing them in alphabetical order of owner and time of deletion. It also gives you the file size and attempts to determine the file type like file(1). This information is useful to identify which of the deleted files you would like to recover.
After selecting the deleted file to be recovered, e2undel assembles its data by reading the data blocks, whose numbers are still stored in the inode, and writes the data to a new file.
An important inclusion in the package is the undel library. This library, loaded by the $LD_PRELOAD mechanism, hooks into the system calls unlink(2) and remove(3), logging the device, inode number, and name of each file that gets deleted by these system calls in a log file, with /var/e2undel/e2undel as the default. With this information, it is possible to recover deleted files by name, which is the best part of this tool. However, note that e2undel will also work without the undel library.
It is essential to note that e2undel does not undelete a file by manipulating the ext2 internal structures like inode, block bitmap, and inode bitmap. Instead, it recovers the data of a deleted file and saves it in a new file.
Regarding requirements, e2undel requires Linux with kernel 2.2 or 2.4 (2.0 should work but is not tested), ext2 filesystem (no ext3, ReiserFS, XFS, JFS, and RAID), glibc 2.2 (tested), but other versions can work. The e2fsprogs packet versions from 1.19 to 1.25 are tested, but older versions should work. Additionally, the e2fsprogs-devel packet (Ted Ts'o's original e2fsprogs packet contains everything necessary).
Installation is simple by compiling with make e2undel-file and then copying the resulting e2undel binary to any directory within your $PATH (e.g., /usr/local/bin).
In summary, e2undel is a useful tool for recovering deleted files in an ext2 file system under Linux, and the inclusion of the undel library makes it stand out.
Access to the ext2 file system is done by way of Ted Ts'o's well-known ext2fs library, ensuring safety in application. Notably, the e2undel package includes a library that enables one to recover deleted files by their names. After installation, e2undel logs the names of all deleted files, making them accessible via the program. The tool then searches for all inodes marked as deleted on a file system, listing them in alphabetical order of owner and time of deletion. It also gives you the file size and attempts to determine the file type like file(1). This information is useful to identify which of the deleted files you would like to recover.
After selecting the deleted file to be recovered, e2undel assembles its data by reading the data blocks, whose numbers are still stored in the inode, and writes the data to a new file.
An important inclusion in the package is the undel library. This library, loaded by the $LD_PRELOAD mechanism, hooks into the system calls unlink(2) and remove(3), logging the device, inode number, and name of each file that gets deleted by these system calls in a log file, with /var/e2undel/e2undel as the default. With this information, it is possible to recover deleted files by name, which is the best part of this tool. However, note that e2undel will also work without the undel library.
It is essential to note that e2undel does not undelete a file by manipulating the ext2 internal structures like inode, block bitmap, and inode bitmap. Instead, it recovers the data of a deleted file and saves it in a new file.
Regarding requirements, e2undel requires Linux with kernel 2.2 or 2.4 (2.0 should work but is not tested), ext2 filesystem (no ext3, ReiserFS, XFS, JFS, and RAID), glibc 2.2 (tested), but other versions can work. The e2fsprogs packet versions from 1.19 to 1.25 are tested, but older versions should work. Additionally, the e2fsprogs-devel packet (Ted Ts'o's original e2fsprogs packet contains everything necessary).
Installation is simple by compiling with make e2undel-file and then copying the resulting e2undel binary to any directory within your $PATH (e.g., /usr/local/bin).
In summary, e2undel is a useful tool for recovering deleted files in an ext2 file system under Linux, and the inclusion of the undel library makes it stand out.
What's New
Version 0.82: N/A