Linux - deleted data recovery

[romulluss]

Hi.. how to recover deleted data on a Linux partition: ext2/ext3?
Data was accidently deleted, and hard drive has never been used since. Problem is R-Studio find no original file/folder structure, same Stellar Phoenix for Linux.. is there anything ele I can use to recover those missing files?

Thank you in advance.

[N.C.]

debugfs can help you if the structure is good enough...

[pcrecovery]

Post says ext2/ext3 , are you sure? There are MANY other FS used in *nix systems...also, mixed as well. Often I see 3 or more different FS on one box.

[pninja]

In Linux/Unix file systems, there is no way to recover File/Folder structure if deleted
intentionally or accidentally. The only solution left is RAW (signature based) recovery.

[N.C.]

In Linux/Unix file systems, there is no way to recover File/Folder structure if deleted
intentionally or accidentally. The only solution left is RAW (signature based) recovery.

disagree

The most of the FSes is restorabel after delete.

[pcrecovery]

In Linux/Unix file systems, there is no way to recover File/Folder structure if deleted
intentionally or accidentally. The only solution left is RAW (signature based) recovery.

AGAIN, it depends very much on "what happened" and the FS...study Ext2 vs Ext3 or UFS and see what happens to deleted files' inode for example...

[pninja]

In Linux/Unix file systems, there is no way to recover File/Folder structure if deleted
intentionally or accidentally. The only solution left is RAW (signature based) recovery.

disagree

The most of the FSes is restorabel after delete.

In rare cases you can use information from journal
(In journaling FS) if you visited the deleted files recently.
Did you mean that?
AFAIK, no commercial recovery software is able to do that.

[N.C.]

In rare cases you can use information from journal
(In journaling FS) if you visited the deleted files recently.
Did you mean that?

Linux have many fs.
Some are more recoverable, some less...
Personally i am supporting the XFS.

AFAIK, no commercial recovery software is able to do that.

Agree, there is no commercial software.
I have seen some ext2/3 undelet solution some years before, but i can't remember for the name or where was i found these...

Janos

[pepe]

on ext3 the inodes are zapped uppon file deletion, so there's no way of restoring a fragmented file based on the file system. This is not true for ext 2, so there are better chances with that.

pepe

[fistron]

ext3grep will find copies of inodes lingering in the journal.

It's best to image ext3 filesystem, even mounting readonly will cause open transactions left in the journal to complete.

[PePa]

to Techtiger4 and techiee - did you check those websites?
There's NO information about the ability to restore deleted files. No wonders why.

From ExtFS, UFS , Reiser and XFS none have real undelete abilities like NTFS or FAT.

Raw recovery for ExtFS is possible, but with some complications (indirect inodes). I know only one program which can work with it properly.

[pepe]

Raw recovery for ExtFS is possible, but with some complications (indirect inodes). I know only one program which can work with it properly.

U surely meant first indirrect blocks. Yes they represent some problem, but it is possible to circumvent it, as I did in my smart RAW rec prog.
So now we have at least 2 progs, since it is not very probable that u use mine

[HardDiskBug]

Yes, there are chances that he used yours, as he seems to be inspired from you..Pepe - Pepa..nice.

[pepe]

not very probable... Unless hacked my PC...