Recover deleted files with ext4magic

sources to read: https://wiki.archlinux.org/title/File_recovery#TestDisk_and_PhotoRec

Ext4magic is another recovery tool for the ext3 and ext4 file system.

Be very careful:

• you must be in a different location, not in the HDD you are trying to recover. The best way is to make a clone of the HDD you are trying to recover, so you can try with different methods.
• You should not write anymore in the disc that you want to recover.
• This method works only for ext3 and ext4 file-systems, so please check what file system you are using before starting.

Example without cloning the HDD:

Before beginning, check what file system you have with the above command:

$ df -Th
Filesystem     Type      Size  Used Avail Use% Mounted on
dev            devtmpfs  3,9G     0  3,9G   0% /dev
run            tmpfs     3,9G  1,8M  3,9G   1% /run
/dev/sda2      ext4      458G  151G  284G  35% /
tmpfs          tmpfs     3,9G  4,3M  3,9G   1% /dev/shm
tmpfs          tmpfs     3,9G   56M  3,8G   2% /tmp

After you determine that you are using ext3 or ext4, go on and plug an external HDD drive and open the terminal from the external HDD

To recover all files, deleted in the last 24 hours:

ext4magic /dev/sdXY -r

To recover a directory or file:

ext4magic /dev/sda2 -f path/to/lost/file -r

The small R flag -r will only recover complete files, that were not overwritten. To also recover broken files, that were partially overwritten, use the big R flag -R. This will also restore not-deleted files and empty directories.

The default destination is ./RECOVERDIR which can be changed by adding the option -d path/to/dest/dir.

If a file exists in the destination directory, the new file is renamed with a trailing hash sign #.

To recover files deleted after 'five days ago':

ext4magic /dev/sdXY -f path/to/lost/file -a $(date -d -5days +%s) -r