13

Has anyone had success recovering deleted files from an ext4 partition? I've tried various utilities, but none have worked yet. I'd be grateful if someone can share a success story!

5 Answers 5

14

You may have luck with:

http://extundelete.sourceforge.net/

However, I've never used it.

Warning: typically these days, filesystems don't support undelete. Trying to recover deleted files is an exercise in computer forensics and you're going to be very lucky to get them back. In particular, if you have written any more files to the disk, chances are your deleted files will be gone forever.

1
  • 2
    Thanks! extundelete actually recovered a lot of files. The tool could be improved, though.
    – Peltier
    Aug 4, 2010 at 12:09
14

First thing is:

  • Do not turn on your computer
  • Start it with a LiveCD or LiveUSB
  • Make a raw clone of the partition, using dd
  • Never mount the partition, but if you need to, mount as read-only

If your data is not encrypted, or is encrypted by blocks, there are tools that look for data in the disk independently of the filesystem. (e.g., photorec)

Extundelete may also do a good job, if your data has been written to the disk or accessed recently, and neither their inodes nor the corresponding data sectors have been overwritten by other files after you deleted.

If the files were inside a stack-encrypted home directory, you can check this.

1
  • +1 for being thorough. Might be a bit much for this situation, but definitely not bad first steps.
    – Aeo
    Aug 17, 2010 at 16:47
5

What worked for me was given by arch (only applies to text files):

grep -a -C 200 -F 'Unique string in text file' /dev/sdXN

Takes a little while, but worked when I accidentally deleted some source code I hadn't commited yet!

1
  • i like the brute-force approach. im using d=/dev/sda1; s=$(df -B1 --output=size $d | tail -n1); cd /run/user/$(id -u); sudo cat $d | pv -s$s | grep --line-buffered -a -b -o -F -e 'some string' >undelete-matches.txt to produce undelete-matches.txt with the byte offsets, and in a second terminal cd /run/user/$(id -u); cat undelete-matches.txt; sudo dd status=none if=/dev/sda1 bs=4096 skip=$(( 25863244507 / 4096 - 1)) count=30 | less
    – milahu
    Nov 13, 2023 at 19:52
1

Have a Windows partition? (To quote Sally Struthers: "Sure, we all do.") Try Piriform's Recuva. It supports ext even though Windows doesn't. Just don't let Windows format your drive.

2
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Jul 2, 2022 at 9:29
  • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review Jul 2, 2022 at 10:03
-2

It depends on how you deleted the files. If you used a graphical file manager you may have "Trash". If you used mc you may have "lost&found". If you used "rm" you have very little to zero chances to recover the file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .