e2undo

Display information about a specific undo file

$ e2undo -h [path/to/undo_file] [/dev/sdXN]

$ e2undo -nv [path/to/undo_file] [/dev/sdXN]

$ e2undo [path/to/undo_file] [/dev/sdXN]

$ e2undo -v [path/to/undo_file] [/dev/sdXN]

$ e2undo -z [path/to/file.e2undo] [path/to/undo_file] [/dev/sdXN]

e2undo [ -fhnvV ] [ -o offset ] undo_log device

-f
    Forces execution, even if the filesystem is mounted or has errors. Use with extreme caution.

-h
    Displays a help message and exits.

-n
    Performs a dry run; does not actually write any changes to the filesystem.

-o offset
    Applies the undo log to a specified device offset, useful for snapshots or LVM.

-v
    Enables verbose output, showing more details about the operation.

-V
    Prints the version information and exits.

undo_log
    The path to the undo log file to be replayed.

device
    The path to the block device containing the Ext2/3/4 filesystem to be modified.

e2undo is a specialized utility designed to reverse metadata changes on Ext2, Ext3, or Ext4 filesystems. It achieves this by replaying an "undo log" file. These undo logs are typically generated by other e2fsprogs utilities like e2fsck (during filesystem checks) or resize2fs (when shrinking a filesystem).

The log captures metadata modifications made by these operations, allowing e2undo to revert the filesystem to its state before the problematic operation occurred. This tool is crucial for disaster recovery scenarios, enabling administrators to recover from unintended or corrupting changes. It is paramount that the target filesystem is NOT mounted when e2undo is executed to prevent data corruption. Users specify the undo log file and the target device where the changes should be applied.

It is CRITICAL that the filesystem specified by device is NOT mounted when e2undo is run. Running it on a mounted filesystem can lead to severe data corruption. Users should also exercise extreme caution when using the -f (force) option.

Undo logs are not generated by e2undo itself. They are typically created by other e2fsprogs utilities such as e2fsck (using the -E undo_dir or -E undo_file option) during a filesystem check, or by resize2fs (using the same options) when shrinking a filesystem. These logs record metadata changes for potential reversal.

e2undo is part of the e2fsprogs project, a comprehensive suite of utilities for maintaining and administering the Ext2, Ext3, and Ext4 filesystems in Linux. Its development is intrinsically tied to the evolution of these filesystems and the persistent need for robust recovery mechanisms. The ability to generate and replay undo logs was introduced to provide a safer way to perform potentially destructive operations like filesystem checks or resizing, allowing administrators to revert changes if an operation fails or results in undesirable outcomes.

e2fsck(8), resize2fs(8), mke2fs(8), debugfs(8)