Recovering files from a Windows FAT/NTFS partition has been discussed previously. This article discusses the steps to recover files from EXT3/EXT4 partitions using an Ubuntu system. The techniques are the same for every Linux distro (except for the installation process, which are distro specific).
Preparation
The first thing to do immediately after realizing you’ve deleted the wrong files is to unmount the file system, or mount as read-only. If the files are on your root partition, you should immediately shut down your system, and boot a live cd. This is very important to prevent other processes from overwriting your files. Even if you don’t explicitly overwrite the files, other system processes could write to the filesystem, and overwrite your files. This article will make use of a system that has a single partition, and uses a Xubuntu live CD to recover the deleted files. The live cd should be started with the option to “try without installing.” On bootup, we launch a terminal, create a mount point using the command: and mount the desired partition
Extundelete
Extundelete is an open source tool and is available on SourceForge. However, you can install it on Ubuntu using:
To restore a single file, (assuming you know the file name) use the command:
To restore all files in a directory, use the command:
Ext4magic
This is also an open source tool, available on SourceForge. It is also available in the Ubuntu repositories and can be installed using: With Ext4magic, the partition can be queried for a list of deleted files and the percentage of the file available for recovery. This can be done using the -a (deleted after the given time) and/or -b (deleted before the given time) options. These times are calculated in seconds since the Unix epoch. A command to find all deleted files within the previous 24 hours in the Music folder, for example, is:
To recover these files, we use the -r option, together with the -d (output directory) option, like so:
Note that the -f option indicates the directory within the partition structure “home/obaro/Music” without the leading “/”. To recover a single file, specify the file name for -f, rather than the directory.
Conclusion
The probability of recovery files using both of these tools drops significantly the longer the partition remains in use after file deletion. This is also affected by conditions where data is being written to the partition/device. It is recommended that the “/home” directory be on a separate partition from your root directory. With a file system structured this way, files can be recovered without resorting to a live cd. The best way to ensure data recovery is to have backups. However, backups will be useless in cases where new files, which haven’t been backed up get deleted.
