How can I recover/undelete files from an ext4 partition?
Rise to the top 3% as a developer or hire one of them at Toptal: https://topt.al/25cXVn
--------------------------------------------------
Music by Eric Matyas
https://www.soundimage.org
Track title: Puzzle Game 5
--
Chapters
00:00 How Can I Recover/Undelete Files From An Ext4 Partition?
00:20 Accepted Answer Score 14
00:49 Answer 2 Score 14
01:31 Answer 3 Score 5
01:48 Answer 4 Score 1
02:05 Thank you
--
Full question
https://superuser.com/questions/170857/h...
--
Content licensed under CC BY-SA
https://meta.stackexchange.com/help/lice...
--
Tags
#linux #filesystems #ext4 #filerecovery
#avk47
ACCEPTED ANSWER
Score 14
You may have luck with:
http://extundelete.sourceforge.net/
However, I've never used it.
Warning: typically these days, filesystems don't support undelete. Trying to recover deleted files is an exercise in computer forensics and you're going to be very lucky to get them back. In particular, if you have written any more files to the disk, chances are your deleted files will be gone forever.
ANSWER 2
Score 14
First thing is:
- Do not turn on your computer
- Start it with a LiveCD or LiveUSB
- Make a raw clone of the partition, using
dd
- Never mount the partition, but if you need to, mount as read-only
If your data is not encrypted, or is encrypted by blocks, there are tools that look for data in the disk independently of the filesystem. (e.g., photorec)
Extundelete may also do a good job, if your data has been written to the disk or accessed recently, and neither their inodes nor the corresponding data sectors have been overwritten by other files after you deleted.
If the files were inside a stack-encrypted home directory, you can check this.
ANSWER 3
Score 5
What worked for me was given by arch (only applies to text files):
grep -a -C 200 -F 'Unique string in text file' /dev/sdXN
Takes a little while, but worked when I accidentally deleted some source code I hadn't commited yet!
ANSWER 4
Score 1
Have a Windows partition? (To quote Sally Struthers: "Sure, we all do.") Try Piriform's Recuva. It supports ext even though Windows doesn't. Just don't let Windows format your drive.