EXT3GREP(8)						 recover files on ext3 filesystems					       EXT3GREP(8)

NAME

       ext3grep - ext3 file recovery tool

SYNOPSIS

       ext3grep [OPTIONS] FILE ...

DESCRIPTION

       ext3grep  is  a	simple tool intended to aid anyone who accidentally deletes a file on an ext3 filesystem, only to find that they wanted it
       shortly thereafter.

OPTIONS

       --superblock
	   Print contents of superblock in addition to the rest. If no action is specified then this option is implied.

       --print
	   Print contents of block or inode, if any.

       --ls
	   Print directories, one line per entry. See the FILTERS section for details on filtering this output.

       --accept FILE
	   Accepts 'file' as a legal filename. Can be used multiple times. If you change any --accept you must remove BOTH stage* files!

       --journal
	   Prints the contents of the journal.

       --show-path-inodes
	   Show the inode of each directory component in paths.

   Filters:
       --group gid
	   Only show/process files owned by process group gid.

       --directory
	   Only show/process process directory inodes.

       --after dtime
	   Only show/process entries deleted on or after dtime.

       --before dtime
	   Only show/process entries deleted before dtime.

       --deleted
	   Only show/process deleted entries.

       --allocated
	   Only show/process allocated inodes/blocks.

       --unallocated
	   Only show/process unallocated inodes/blocks.

       --reallocated
	   Do not suppress entries with reallocated inodes. Inodes are considered 'reallocated' if the entry is deleted but  the  inode  is  allo-
	   cated, but also when the file type in the dir entry and the inode are different.

       --zeroed-inodes
	   Do not suppress entries with zeroed inodes. Linked entries are always shown, regardless of this option.

       --depth depth
	   Process directories recursively up till a depth of 'depth'.

   Actions:
       --inode-to-block inode_num
	   Print the block that contains inode inode_num.

       --inode inode_num
	   Show  info on inode inode_num. If --ls is used and the inode is a directory, then the filters apply to the entries of the directory. If
	   you do not use --ls then --print is implied.

       --block block_num
	   Show info on block block_num. If --ls is used and the block is the first block of a directory, then the filters apply to entries of the
	   directory. If you do not use --ls then --print is implied.

       --histogram=[atime|ctime|mtime|dtime|group]
	   Generate  a	histogram  based  on the given specs. Using atime, ctime or mtime will change the meaning of --after and --before to those
	   times.

       --journal-block block_num
	   Show info on journal block block_num.

       --journal-transaction seq
	   Show info on transaction with sequence number seq.

       --dump-names
	   Write the paths of files to stdout. This implies --ls but suppresses its output.

       --search-start str
	   Find blocks that start with the fixed string str.

       --search str
	   Find blocks that contain the fixed string str.

       --search-inode block_num
	   Find inodes that refer to block block_num.

       --search-zeroed-inodes
	   Return allocated inode table entries that are zeroed.

       --inode-dirblock-table dir
	   Print a table for directory path dir of directory block numbers found and the inodes used for each file.

       --show-journal-inodes inode_num
	   Show copies of inode inode_num still in the journal.

       --restore-file path
	   Will restore file path. path is relative to root of the partition and does not start with a '/' (it must be one of the  paths  returned
	   by --dump-names). The restored directory, file or symbolic link is created in the current directory as ./path.

       --restore-all
	   As  --restore-file but attempts to restore everything. The use of --after is highly recommended because the attempt to restore very old
	   files will only result in them being hard linked to a more recently deleted file and as such pollute the output.

       --show-hardlinks
	   Show all inodes that are shared by two or more files.

       --version, -[vV]
	   Prints the version information and exits.

       --help,
	   Prints a help message and exits.

EXAMPLES

       Restoring all files from the ext3 partition/file /backup/sda1:
       ext3grep --restore-all /backup/sda1
       Listing the files owned by GID 1000 on /backup/sda1:
       ext3grep --ls --group 1000 /backup/sda1
       Finding all files containing the string Critical_report in their name on /backup/sda1:
       ext3grep --dump-names /backup/sda1 | grep 'Critical_report'

LIMITATIONS

       Do not attempt to use ext3grep for recovery from a mounted filesystem. Ever.

       No, not even then.

       ext3grep sometimes runs out of memory spare on 32-bit architectures and crashes. It is highly recommended that you run ext3grep in a 64-bit
       environment when dealing with large filesystems, though this is seen as a bug.

       ext3grep cannot recover files if there are no remnants of them.

       Some files that ext3grep recovers may have trailing null bytes - just scrape them off like the burnt bits on toast.

SEE ALSO

       debugfs(8)

AUTHOR

       ext3grep was written by Carlo Wood <carlo@alinoe.com>.

       This manual page was written by Rich Ercolani <rercola@acm.jhu.edu>, for the Debian project (but may be used by others). It may be distrib-
       uted under the same terms as ext3grep, the GNU General Public License, either version 2 or (at your option) any later version.

0.8.0								    2008-09-14							       EXT3GREP(8)