Recovering files deleted from Linux (ext3) and FreeBSD partitions

Rate this item
(0 votes)

The easiest way is to use the TestDisk universal utility (http://www.cgsecurity.org/wiki/TestDisk, /usr/ports/sysutils/testdisk), which supports a variety of file systems, for instance, ext2, ext3, ufs, fat, NTFS. Besides file recovery, TestDisk can find and recover the contents of the deleted drive partitions.

For recovery of deleted files by their type (i.e. photos), you can use the PhotoRec tool (http://www.cgsecurity.org/wiki/PhotoRec).

Both TestDisk and PhotoRec utilities work in the interactive fashion, gradually refining recovery options.

It is enough to unmount a partition, from which we are going to recover files, execute "testdisk" and select the desired recovery options.

The demonstration of the recovery process is given in the screenshot reviews:

http://www.cgsecurity.org/wiki/TestDisk:_undelete_file_for_ext2

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

The second way is more suitable for Ext3 users and is associated with the use of ext3grep tool.

Install ext3grep (http://code.google.com/p/ext3grep/) or better boot from the LiveCD which contains the utility, for example PartedMagic (http://partedmagic.com/), occupying about 50 Mb.

Let's suppose that files from the directory /home/test/db, located on the ext3 /dev/sda6 partition, were accidentally deleted.

The faster we attempt to recover them, the higher the probability of success is.

We make sure that the /dev/sda6 partition is not mounted. And go to the directory, available for writing and having enough space for the recovered files.

To recover the /home/test/db/test.txt file we run

   ext3grep /dev/sda6 --restore-file test/db/test.txt

To recover the directory

   ext3grep /dev/sda6 --restore-file test/db

The recovery results will be placed in the RESTORED_FILES directory, which will be created by ext3grep utility in the current directory.

We can view all found file names by executing the following command:

   ext3grep /dev/sda6 --dump-names

To recover all the files deleted from the time 1202351117:

   ext3grep /dev/sda6 --restore-all --after=1202351117

If 30 minutes passed after removal, you can see a timestamp, for example, as follows:

   perl -e 'print time()-30*60';

Last modified on Monday, 18 May 2015 19:24
Data Recovery Expert

Viktor S., Ph.D. (Electrical/Computer Engineering), was hired by DataRecoup, the international data recovery corporation, in 2012. Promoted to Engineering Senior Manager in 2010 and then to his current position, as C.I.O. of DataRecoup, in 2014. Responsible for the management of critical, high-priority RAID data recovery cases and the application of his expert, comprehensive knowledge in database data retrieval. He is also responsible for planning and implementing SEO/SEM and other internet-based marketing strategies. Currently, Viktor S., Ph.D., is focusing on the further development and expansion of DataRecoup’s major internet marketing campaign for their already successful proprietary software application “Data Recovery for Windows” (an application which he developed).

33 comments

  • Comment Link Wilson Sunday, 12 November 2017 20:01 posted by Wilson

    Hello! I simply wish to give you a big thumbs up for your great info you have got right here on this post.
    I'll be returning to your website for more soon.

  • Comment Link Harris Sunday, 12 November 2017 03:14 posted by Harris

    Do you got dropping deck gate inside your house?

  • Comment Link Tammie Friday, 10 November 2017 19:36 posted by Tammie

    Terrific article! That is the type of information that should be shared around the internet.
    Disgrace on Google for now not positioning this put up upper!
    Come on over and visit my web site . Thank
    you =)

  • Comment Link Wilfredo Thursday, 09 November 2017 22:17 posted by Wilfredo

    Asking questions are really nice thing if you are not understanding
    something fully, but this paragraph gives fastidious understanding yet.

  • Comment Link Saul Wednesday, 08 November 2017 08:24 posted by Saul

    Hello there! Do you use Twitter? I'd like to follow you
    if that would be okay. I'm undoubtedly enjoying your blog and look forward to new updates.

  • Comment Link Chara Tuesday, 07 November 2017 03:50 posted by Chara

    You really make it appear really easy with your presentation however I find this matter to be actually one thing which I feel I might never understand.
    It kind of feels too complicated and extremely broad for
    me. I am looking ahead on your subsequent put up,
    I'll attempt to get the grasp of it!

  • Comment Link Jeramy Monday, 06 November 2017 14:46 posted by Jeramy

    Wow, superb weblog format! How long have you ever been running a blog for?

    you make running a blog look easy. The whole look of your website is fantastic,
    let alone the content!

  • Comment Link Makayla Friday, 03 November 2017 23:30 posted by Makayla

    Yes! Finally someone writes about pay monthly phone.

  • Comment Link Emilia Friday, 03 November 2017 16:36 posted by Emilia

    It's wonderful that you are getting thoughts from this post as well as
    from our discussion made here.

  • Comment Link Ines Wednesday, 01 November 2017 07:15 posted by Ines

    Hi! I've been reading your blog for a while now and
    finally got the courage to go ahead and give you a shout out from Porter Tx!
    Just wanted to tell you keep up the excellent job!

Leave a comment

Make sure you enter the (*) required information where indicated. HTML code is not allowed.