My mother has placed some important files on her /tmp per accident. Now, of course, they are gone.

This happened yesterday (2 boots of the machine since)

I want to try to undelete the files. They were on /tmp, which was on the same partition as the rest of / , so I need a tool that runs on a mounted system (or maybe I could use a livecd ...)

Right now, I am trying testdisk on a systemrescuecd that I just downloaded. I can get some files from /tmp, but not all. (is it the right tool ? What exactly are those "red" files ? are only some of them recoverable ?)

  • The best solution is probably a backup and the next best solution for someone who is technically less apt than you perhaps btrfs with frequent snapshots. Packages like restic, rdiff-backup, duplicity or backintime-qt may also be of interest. None of this is going to help you in retrospect, but perhaps this comment helps future visitors. Jun 17, 2020 at 14:41
  • For me extundelete segments, while testdisk whips out a list of differences. Now to see if it can get the files back.
    – Vorac
    Oct 18, 2020 at 10:14

5 Answers 5


You can also use extundelete

First unmount (umount) the file system where the files have been deleted.
Then read the chapter What to do if you've deleted a file.

You can install extundelete from classic Ubuntu repository:

sudo apt-get install extundelete

Or better, you can download the latest version and compile it:

cd ~/Download
tar -xf extundelete-*.*.*-.tar.bz2  #Replace *.*.* by the version
cd      extundelete-*.*.*
sudo apt-get install e2fslibs-dev   #Required for compilation
sudo make install
extundelete --version               #Should be your *.*.* version

Example of usage: restore all deleted files from directory Images into new created directory restore

sudo extundelete --restore-directory Images/ -o restore /dev/sda3

Bad news if you see your file XXXX within the following format:

Unable to restore inode NNN (Images/XXXX): Space has been reallocated.

See all restored files (look for your file):

find restore -name '*'

Backup your file(s) and remove this temporary directory restore

sudo rm -rf restore  
  • 6
    This answer has literally just saved my job. Thankyou.
    – Twifty
    Aug 1, 2017 at 20:14
  • I get segmentation fault, core dumped.
    – Onza
    Jan 19 at 0:20

Data recovery, especially on EXT file systems, should be attempted from a live CD or other system that isn't depending on the partition you're undeleting from. Getting the disk unmounted or re-mounted as read only helps a great deal in the recovery effort.

Most of the time I try to create an image of the partition or disk using dd or a similar tool, so that I'm not working on the disk itself:

dd if=/dev/sd[xx] of=/media/backup_drive/recovery.img

Once you have your image, you can use a tool like ext3grep to try and find the files you're looking for. There are lots of different switches that you can try, but this might be a good start:

ext3grep --restore-file 'tmp/moms-file.txt' recovery.img

The ext3grep utility also provides several different ways to search through the file system if you don't know the name of the file. Check ext3grep --help for the various methods of searching.

  • It would be nice, if you could add the exact steps?
    – saji89
    Nov 15, 2012 at 15:20
  • @saji89 Added a sample usage - also fixed to link to the right utility!
    – Windigo
    Nov 15, 2012 at 19:28
  • nice. now ... does it work with ext4 ?
    – josinalvo
    Nov 16, 2012 at 15:11
  • 1
    @josinalvo I was working with an EXT4 volume when I tried it, and it did work; it didn't find the files I was looking for, but I think I had missed the window of opportunity.
    – Windigo
    Nov 21, 2012 at 16:16

I prefered to use ext4magic as :

sudo ext4magic  /dev/sdc3 -r -f $USERl/Documents/ -d /tmp/local/tmp/

Note you have to resolv symlink by your own







Parse data blocks for EXT directory data.

Detailed documentation on EXT4 can be found here:

Download the perl script with

git clone https://github.com/halpomeranz/analyzeEXT

No guarantee but may be able to reconstruct deleted filesystems.

  • 1
    What is this tool exactly? How do you use it? I've read the repo description and the help message in the script, but there's not much detail.
    – wjandrea
    Aug 26, 2018 at 18:42
  • Took a look at the perl script; the cli help doesn't match with the script!
    – abu_bua
    Aug 26, 2018 at 20:17
  • More details are here. I stumbled up on it - never used it! youtube.com/watch?v=6pzm6909IvY
    – jouell
    Aug 27, 2018 at 0:42
  • @jouell I've watched 2:30 of the video and he hasn't mentioned the script yet. Could you edit your answer to add a brief summary?
    – wjandrea
    Aug 27, 2018 at 4:46

I could not recover my crontab file by using ext4magic or extundelete.

On Debian, the crontab for root is here:


But, by using the following command, I was able to at least manually recover my crontab from the logs.

 grep CRON /var/log/syslog.* -i| awk -F " CMD " {'print $2;'} |sort | uniq

It will output only the executed cron jobs (no timings), but at least this is a lot more than starting from scratch.

If you don't remember how often certain cron jobs run, take a full log e.g. syslog.1 and this will give you the count for runs trough the day:

grep CRON /var/log/syslog.1 -i| awk -F " CMD " {'print $2;'} |sort | uniq -c |sort -n

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.