example for restore deleted file on ext3/ext4

example_restore_file.md

# create a file and assign to a loop block device

# create a test file
dd if=/dev/zero of=test.img bs=1M count=100

# make the file to be a block device
losetup /dev/loop0 ./test.img

# create ext4 filesystem
mkfs.ext4 /dev/loop0

mount /dev/loop0 /mnt

# copy files to filesystem
cp /bin/* /mnt
sync

# record the delete time
t=$(date "+%s")  # the time when file deleted

# delete file
rm -f /mnt/l* 
rm -f /mnt/s*

# umount, prevent future write to overwrite the file content what been deleted
umount /mnt

# restore
extundelete /dev/loop0 --restore-all --after $t  #  restore all files after $t

# see restored file
ls RECOVERED_FILES  # all files restored here