Linux Data Recovery Through Ext3grep Utility
Submitted by jonnydefh@gmail.com on Mon, 2010-01-04 12:17
The Linux file systems are extremely powerful and they work great, particularly the Ext3 file system. It is an extremely robust and mature file system. The file system remains consistent even after a system crash or unexpected power failure. In such cases, you need not to perform long hard drive checks for repairing the file system. There is no possibility of disk fragmentation and a number of more advanced feature and direct deletion of files is one among them. When you delete a file, it is not moved to trash and you do not encounter any message box. But this feature increases the chances of accidental deletion and require Linux Data Recovery if you remove any significant file.
It happens to almost every Linux user sooner or later, just after pressing the Enter key, you realize the mistake, but it's so late. You have deleted a critical file from your Linux hard drive for which you do not have backup. Or may be the backup is not updated or damaged. It may create panic situations for most of the users, but you should keep in mind that files are folders are never deleted physically from the hard drive.
After you delete the file or directory, it remains physically intact until it is being overwritten by any other file or directory. Thus, you need to immediately remount the hard drive as read-only. There are various methods of perform Data Recovery Linux automatically or manually. Most of the computer operating systems has some or the other utilities to retrieve deleted files.
In Ext3 file system, you can use Ext3grep utility to retrieve deleted files from the Linux hard drive. It is actually a Linux utility, which is able to retrieve completely deleted files from Ext3 file system volumes. Using this utility is completely safe as it does not overwrite data on the disk.
Although, the Ext3grep is a quite significant and useful utility to recover lost Linux data, but it has some disadvantages as well. This tool can not recover files that are larger than 2 GB in size and can not retrieve files that are deleted due to any other reason.
In these cases, Linux Data Recovery applications come for your rescue. These are effective third party utilities, which allow you to perform Linux Recovery on your own. With read-only and non-destructive conduct, the applications are completely safe to use.
Stellar Phoenix Linux Data Recovery is the most efficient solution for all Linux data loss situations. It recovers data from Ext4, Ext3, Ext2, FAT32, FAT16, and FAT12 file system volumes. The software works with all major distributions of Linux operating system including Mandriva, SUSE, Red Hat, Fedora, and Debian.
»
- jonnydefh@gmail.com's blog
- Add new comment
- 5098 reads
This is what most people do,
This is what most people do, they perform hard drive check after the crashes and that only makes things worse for the hard drive recovery perspective. Another common mistake is that people search for data recovery software without being aware of what they really need to get, this leads into partial data recovery on one side with permanent data loss on the other side. All we need to do is to be more informed before we get to the action, this would minimize the risks.
Hi Johnny. Thanks for your
Hi Johnny. Thanks for your posting. I think Ext3grep works quite well, but when it comes to the option "Restore All" it recovers not all accidentally deleted files, instead it
recovers files that had been deleted long before and that actually
haven't been deleted. this makes me puzzled.
Is there anything I can do about it, Would you help me.
Thanks in advance.
Regards
Mike Computer File Recovery
use more of the power of ext3grep
(months later, probably way past point of orig poster caring)
Mike, I dont think you read enough of the 28page doc from
http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html ( ext3grep freeware )
It shows that a GOOD recovery includes pinpointing the TIME PERIOD
of the deletion.... ext3grep --histogram=dtime shows this,
if you give it a range of timestamps in the UNIX traditional seconds since 1970.
That makes it easy to see the deadly time period if a LOT of files were oops/removed.
Then you add to the wonderful "ext3grep .... --restore-all" command,
a couple arguments ( telling it to only process deletions within this time range )
i.e. add arguments " --after NNNNNNNNNNN --before NNNNNNNNNN "
Other parts of the documentation are clear on the (nice) fact that NON-deleted
files are also restored with this command. Which seems like what we'd all want,
while letting ext3grep create a "new copy" elsewhere while reading a broken fsys (or image copy of it).