4

I'm using Ubuntu 16.04. I mistakenly shift+deleted files and folders in my Documents folder. I'm trying to use extundelete utility but which is not helping me.

I don't know which sda* to be used. Please help me out with this.

$ sudo extundelete --restore-all --after $(date -d "-2 hours" +%s) /dev/sda

which shows the following output:

Only show and process deleted entries if they are deleted on or after 1521022350 and before 9223372036854775807.

extundelete: Bad magic number in super-block when trying to open filesystem /dev/sda

When I do 

$ sudo fdisk -l

it shows the following:

screenshot

Please help me out how to recover data using extundelete

muru
  • 207,228
php12345
  • 41

2 Answers2

2

sda is the whole drive, you should use sda5 as this appears to be your OS-partition. So if you modify your command to

sudo extundelete --restore-all --after $(date -d "-2 hours" +%s) /dev/sda5

it should work as you expect.

mook765
  • 18,644
2

It looks like you're trying to use extundelete on a mounted partition. Rather, you should use a Ubuntu Live DVD or USB to boot, install extundelete in the live system, and then use it on the unmounted /dev/sda5 partition.

You'll also need some other media (another USB stick will do) to restore those deleted files to.

This guide should walk you through it: The Magic of Extundelete

0x01
  • 279