Today Accidentally I deleted one of my folder in ubuntu which has contained important files, but I wanted to copy those to another machine by tarring it, while there was another archive / tar with same name, I wanted to delete that .tar but deleted folder resulting deleting very important files. To recover those files immidiately I used following commands, $ sudo apt-get install extundelete Now check where the hard disk is mounted using df -h command, in our case it was at /dev/sda1 $ df -h Filesystem Size Used Avail Use% Mounted on udev 1.9G 12K 1.9G 1% /dev tmpfs 387M 700K 386M 1% /run /dev/sda1 455G 210G 222G 49% / $ sudo extundelete --restore-directory /home/myuser/path-of-deleted-folder/deleted-folder-name /dev/sda1 password for myuser: WARNING: Extended attributes are not restored. WARNING: EXT3_FEATURE_INCOMPAT_RECOVER is set The partition should be unmounted to undelete any files without further data loss.

Execution & Command Syntax

Terminalbash
sed following commands, $ sudo apt-get install extundelete Now check where the hard disk is mounted using df -h command, in our case it was at /dev/sda1 $ df -h Filesystem Size Used Avail Use% Mounted on udev 1

Risk level: caution. Review the command before running it.

Terminalbash
sudo extundelete --restore-directory /home/myuser/path-of-deleted-folder/deleted-folder-name /dev/sda1 password for myuser: WARNING: Extended attributes are not restored

Risk level: caution. Review the command before running it.

Terminalbash
make recovering those files impossible

Technical Implementation Details

If the partition is not currently mounted, this message indicates it was improperly unmounted, and you should run fsck before continuing. If you decide to continue, extundelete may overwrite some of the deleted files and make recovering those files impossible. You should unmount the file system and check it with fsck before using extundelete. Would you like to continue? (y/n) y Loading filesystem metadata … 3695 groups loaded. Loading journal descriptors … 29653 descriptors loaded.

Gotchas and Common Issues

  • Permission Verification - confirm execution permissions and path variables before invoking system binaries.

  • Version Compatibility - check software version release notes for deprecated flags or syntax changes.

  • Log Monitoring - inspect system logs (journalctl or /var/log) to troubleshoot execution failures.

Following these steps ensures clean configuration, proper security boundaries, and reliable execution for recover data / folder deleted with rm -rf.