Recovering files deleted from Linux (ext3) and FreeBSD partitions

Rate this item
(0 votes)

The easiest way is to use the TestDisk universal utility (http://www.cgsecurity.org/wiki/TestDisk, /usr/ports/sysutils/testdisk), which supports a variety of file systems, for instance, ext2, ext3, ufs, fat, NTFS. Besides file recovery, TestDisk can find and recover the contents of the deleted drive partitions.

For recovery of deleted files by their type (i.e. photos), you can use the PhotoRec tool (http://www.cgsecurity.org/wiki/PhotoRec).

Both TestDisk and PhotoRec utilities work in the interactive fashion, gradually refining recovery options.

It is enough to unmount a partition, from which we are going to recover files, execute "testdisk" and select the desired recovery options.

The demonstration of the recovery process is given in the screenshot reviews:

http://www.cgsecurity.org/wiki/TestDisk:_undelete_file_for_ext2

http://www.cgsecurity.org/wiki/TestDisk_Step_By_Step

The second way is more suitable for Ext3 users and is associated with the use of ext3grep tool.

Install ext3grep (http://code.google.com/p/ext3grep/) or better boot from the LiveCD which contains the utility, for example PartedMagic (http://partedmagic.com/), occupying about 50 Mb.

Let's suppose that files from the directory /home/test/db, located on the ext3 /dev/sda6 partition, were accidentally deleted.

The faster we attempt to recover them, the higher the probability of success is.

We make sure that the /dev/sda6 partition is not mounted. And go to the directory, available for writing and having enough space for the recovered files.

To recover the /home/test/db/test.txt file we run

   ext3grep /dev/sda6 --restore-file test/db/test.txt

To recover the directory

   ext3grep /dev/sda6 --restore-file test/db

The recovery results will be placed in the RESTORED_FILES directory, which will be created by ext3grep utility in the current directory.

We can view all found file names by executing the following command:

   ext3grep /dev/sda6 --dump-names

To recover all the files deleted from the time 1202351117:

   ext3grep /dev/sda6 --restore-all --after=1202351117

If 30 minutes passed after removal, you can see a timestamp, for example, as follows:

   perl -e 'print time()-30*60';

Last modified on Monday, 18 May 2015 19:24
Data Recovery Expert

Viktor S., Ph.D. (Electrical/Computer Engineering), was hired by DataRecoup, the international data recovery corporation, in 2012. Promoted to Engineering Senior Manager in 2010 and then to his current position, as C.I.O. of DataRecoup, in 2014. Responsible for the management of critical, high-priority RAID data recovery cases and the application of his expert, comprehensive knowledge in database data retrieval. He is also responsible for planning and implementing SEO/SEM and other internet-based marketing strategies. Currently, Viktor S., Ph.D., is focusing on the further development and expansion of DataRecoup’s major internet marketing campaign for their already successful proprietary software application “Data Recovery for Windows” (an application which he developed).

41 comments

  • Comment Link Peggy Friday, 23 February 2018 06:39 posted by Peggy

    © 2017 SelectQuote Insurance coverage Services.

  • Comment Link Rudy Thursday, 15 February 2018 06:55 posted by Rudy

    Worldwide motor yacht brokerage specialists.

  • Comment Link Marcelino Friday, 09 February 2018 11:53 posted by Marcelino

    Towing Miami is a family owned towing company in Miami.

  • Comment Link Jacquelyn Wednesday, 07 February 2018 21:53 posted by Jacquelyn

    This limousine service was simply absolutely splendid.

  • Comment Link Gerardo Wednesday, 31 January 2018 14:42 posted by Gerardo

    Greetings from Florida! I'm bored to tears at work so I decided to check out your website on my iphone
    during lunch break. I love the info you present here and can't
    wait to take a look when I get home. I'm shocked
    at how quick your blog loaded on my cell phone
    .. I'm not even using WIFI, just 3G .. Anyways, wonderful site!

  • Comment Link Monique Tuesday, 23 January 2018 19:59 posted by Monique

    I visit everyday a few web sites and information sites to read articles or reviews,
    except this weblog presents feature based articles.

  • Comment Link Brianne Tuesday, 23 January 2018 16:14 posted by Brianne

    Hi there! Would you mind if I share your blog with my twitter group?
    There's a lot of folks that I think would really enjoy your content.
    Please let me know. Many thanks

  • Comment Link Shayna Sunday, 26 November 2017 23:52 posted by Shayna

    Having read this I thought it was rather enlightening.
    I appreciate you finding the time and effort to put this informative article together.
    I once again find myself personally spending a significant amount of time both reading and leaving comments.
    But so what, it was still worthwhile!

  • Comment Link Wilson Sunday, 12 November 2017 20:01 posted by Wilson

    Hello! I simply wish to give you a big thumbs up for your great info you have got right here on this post.
    I'll be returning to your website for more soon.

  • Comment Link Harris Sunday, 12 November 2017 03:14 posted by Harris

    Do you got dropping deck gate inside your house?

Leave a comment

Make sure you enter the (*) required information where indicated. HTML code is not allowed.