Tink vs extundelete
extundelete restores deleted ext3/ext4 files from the journal. That is not a mechanic. Tink installs in one command, watches the Linux host, explains what is wrong, and helps you fix it.
extundelete recovers the inodes. Tink answers “why is this VPS sick?”
Accidental sysadmins land on extundelete because a free journal undelete looks like insurance. Then the host volume fills, nginx dies, and the last RECOVERED_FILES tree still looks complete — no --restore-all match for host fill. A filling /var is a Tink warning; it is not an extundelete job unless you scraped recovery mail and watched it.
Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep using extundelete if you already run journal undelete. Use Tink if you run Linux servers and want a mechanic.
| Feature | Tink | extundelete |
|---|---|---|
| Setup time | 30 seconds (one curl | sh command) | Hours — umount /dev/sdXN, run extundelete --restore-all, wait for RECOVERED_FILES, then a host that still has no mechanic after the last journal replay finished |
| What you get | Working monitoring, diagnosis, and approved fixes | An ext3/ext4 journal undelete tool. Disk fill, nginx, Postgres, and certs stay your problem until you SSH past the last RECOVERED_FILES tree |
| Pricing | Free (Scout) / $9 / $29 per machine per month | GPL and free. You still pay the person who owns the VPS after the last extundelete --restore-all looks finished |
| Hidden costs | None — fully managed | A quiet RECOVERED_FILES tree that is not host fill, downtime to umount, journal-inode homework, and a second tool to tell you the box is sick while the last restore still showed complete |
| Monitoring approach | Agent on the server — CPU, disk, services, logs, certs, ports | extundelete --restore-all, --restore-file, --restore-directory, inode lists. extundelete does not watch a quiet cert or host auth.log after the last recovery session ended |
| Configuration | None after install — heuristics and AI | Which /dev/sdXN to undelete, umount vs --restore-inode, output dir, and which failed extundelete session actually pages you |
| Plain-English diagnosis | Yes — AI explains root cause, impact, and fix | You read the restore log and RECOVERED_FILES, then SSH into the host to change the Linux box extundelete already pulled inodes off |
| Fix execution | Proposes and executes approved commands with an audit trail | Replay journal inodes into RECOVERED_FILES — extundelete cannot free host disk, rotate a cert, or stop SSH brute-force unless you run --restore-all again |
| Alerting | Built-in across 8 channels | Not an extundelete job — cron mail from a failed restore plus a separate monitoring tool have to fire |
| Predictive alerts | Yes — disk fills in ~6 days, memory and CPU trends | Not an extundelete job — a restore log date does not forecast a quiet host filling up |
| SSH brute-force detection | Built-in — parses auth.log every scan | Never — extundelete does not read host auth.log, journald, or firewall state after the last recovery session ended |
| Machine offline detection | Agent presence monitoring with multi-channel alerts | Silence if the host dies after the last extundelete --restore-all — unless you built a separate uptime check |
| Public status page | Shareable URL with 90-day history | None — extundelete has no customer-facing status page for the Linux host |
| Weekly fleet digest | Automated Monday digest + daily brief when issues are open | None — a restore-all recap is not a plain-English fleet narrative |
| On-call tracking | Built-in /oncall command + incident acknowledgment | Not included — wire failed extundelete restores into PagerDuty or another incident tool |
| Conversation interface | Telegram, WhatsApp, web dashboard, CLI | The extundelete CLI, umount, and SSH. No mechanic you text when /var filled and the last --restore-all still showed complete |
| Learning curve | None — works after install | Steep — umount, --restore-all, --restore-file, --inode, RECOVERED_FILES, and which failure is the undelete vs the running host |
| Best for | Freelancers, small teams, accidental sysadmins (1-50 Linux servers) | Teams that already run extundelete for journal undelete, not a sick-VPS mechanic |
When extundelete is the right choice
Keep using extundelete when you already want that exact job:
- Journal undelete — you need extundelete --restore-all, --restore-file, or inode lists, not a mechanic.
- An existing recovery stack — umounted ext3/ext4 volumes, disk images, and a lab LAN matter more than guest nginx, certs, and SSH on a quiet VPS.
- An existing lab or nested setup — extundelete already runs, RECOVERED_FILES already exists, and someone owns the unmounted device.
- Hosts that only page on image or restore death — you already run failed-backup mail, not a sick-box SSH loop.
The real cost of “just run extundelete”
extundelete restores inodes. A working ops loop for five Linux boxes is not:
- A healthy --restore-all still means you SSH into the host and change the box by hand when it gets sick later
- Host fill, nginx, certs, and SSH brute-force never appear unless a separate tool scraped those signals and a rule fired
- A filling /var is a Tink disk warning on every scan — extundelete will stay quiet until the next recovery session
- A single VPS with a dead agent still needs a mechanic, not another extundelete --restore-all
For a 5-server team, Tink Mechanic at $45/month is cheaper than the engineer who keeps failed-backup notifications alive after a green extundelete session, and every scan includes a diagnosis a quiet RECOVERED_FILES tree will not type.
No RECOVERED_FILES or umount homework. No silent host. One command install.
Start MechanicAlso compare: Tink vs PhotoRec · Tink vs TestDisk · Tink vs GNU ddrescue