Data Recovery

From Wikibooks, open books for an open world
Jump to navigation Jump to search

Recovering data from an EXT3 disk[edit]

Although most sources of basic information on the EXT3 disk format states that you can't recover deleted files [1] it's not strictly true. As they also state, you can 'grep' for text in the partition and in that way recover many types of files.

Strangely many tools for recovery of EXT2 and EXT3 disks actually run on the windows platform instead of the Linux platform which uses these formats.

Before heading for powerful tools which can take a long time to run it is worth thinking about the type(s) of information you want to recover. Information stored as plain text can be easily recovered inside a working GNU/Linux installation with a command which simply writes what it finds on the partition to a text file[2]. In the example /dev/sda7 has the information we want and /path/to/big_text_file is where the information will be saved as one big text file. Make sure there is enough space for it and do not put it on the partition you are trying to recover from:

#strings /dev/sda7 > /path/to/big_text_file

The GNU/Linux tool TestDisk[3] can find and recreate lost partitions, and its sister project PhotoRec[4] can recover many types of image and video files by looking for the distinctive pattern at the start of such files.

A slightly different tool is giis[5] which allows for recovery of files deleted after it is installed.