Ext4 Rewind is a crude attempt to automate deleted file analysis and recovery from ext4 file-systems.
The underlying logic is likely not that different from related tools.
However, going through the process manually is insightful for understanding how deleted files could be recovered.
This code is crude, uncommented, and relies on the output format of sleuthkit tools (which is far from a stable API).
Ext4 Rewind is built on-top of sleuthkit command line tools.
A fork of sleuthkit is currently required until this issue is resolved upstream.
The journal command will print journal commit blocks in reverse chronological order.
ext4rewind.py /dev/mapper/dvg-home journal
The inode command will print an inode in reverse chronological order.
ext4rewind.py /dev/mapper/dvg-home inode 131074
The dir command will print a directory entry in reverse chronological order.
ext4rewind.py /dev/mapper/dvg-home dir 131074
The extent command will print an extent in reverse chronological order.
ext4rewind.py /dev/mapper/dvg-home extent 558590
The blocks command will print the content of data blocks.
ext4rewind.py /dev/mapper/dvg-home blocks 532513 532583-532584