extundelete

Restore all deleted files from partition

$ sudo extundelete [/dev/sdXN] --restore-all

$ extundelete [/dev/sdXN] --restore-file [path/to/file]

$ extundelete [/dev/sdXN] --restore-directory [path/to/directory]

$ extundelete [/dev/sdXN] --restore-all --after [1577840400]

extundelete device [options]

extundelete recovers deleted files from ext3 and ext4 partitions by parsing the filesystem journal. It can restore individual files, directories, or all recoverable files.
Works best when run immediately after deletion before journal wraps.

--restore-all

Restore all recoverable files

Restore specific file

Restore specific directory

Only restore files deleted after Unix timestamp

Only restore files deleted before timestamp

Only works with ext3/ext4 filesystems. Unmount partition before recovery for best results. Paths are relative to filesystem root (no leading /). Recovery success depends on journal state.

testdisk(8), photorec(8), debugfs(8)