Ext3 data recovery

[TaskManager]

Hello everybody

I have a case where customer has deleted data from linux ext3 file system. I think unlike windows linux does not keep track of records since it is journaling file system. since this is my first case I would like to know possible chances of recovery.
thank you

[SquaL]

Hi check out linux-file-recovery-freeware-for-extfs-partitions-t19958.html

[poehere]

If this is really your first case then you should know that you have to clone your HDD before attempting any recovery on this one.

Second if you find your files never write them back to the same disk they were on to begin with.

Thrid never attempt a recovery program on a disk like this before cloning it and working with your clone. If you make an error you can always clone it again and the clients disk stays as it is.

[TaskManager]

thanks squal & poehere
yes first task will be to clone disk sector by sector and to work on image only.

[XXL]

There is no need to the clone drive, if you feel comfortable enough working with it, without making blatantly obvious mistakes - one of them, of course, is writing data to the source drive, as has already been mentioned. Generally, this operation is more or less safe (taking the said above into account) - however, if the drive is in a bad shape (degraded heads, surface damage, etc), then such approach might be unfitting. If the drive is fine - then doing a simple recovery, of a deleted file, shouldn't be all that hard.

Take a look at a package called testdisk in the repositories of Debian GNU/Linux. In case this was a text-only filetype - you can even use a tool called grep, on an according partition, to try and match a pattern or a keyword, that was inside the file. Sort of "search in contents". Correct me if I'm wrong, but from what I recall, only inodes should be purged on a regular delete operation in regards to the ext filesystem - so your file is still there, unless something has already been written over its sector space.

[drc]

There is no need to the clone drive, if you feel comfortable enough working with it, without making blatantly obvious mistakes

Just as there is no need to wear safety equipment when mountain-climbing, if you feel comfortable enough doing it without making blatantly obvious mistakes?

[XXL]

There is no need to the clone drive, if you feel comfortable enough working with it, without making blatantly obvious mistakes

Just as there is no need to wear safety equipment when mountain-climbing, if you feel comfortable enough doing it without making blatantly obvious mistakes?

So just choosing an according path to save files, when you are reminded and warned in a dialog about this exact thing in testdisk, is the same as reaching the top of a mountain without safety equipment, while being in danger every second? Right.

Just as there's a need of wearing an IRON MAN suite while taking a walk in the park.

[drc]

There is no need to the clone drive, if you feel comfortable enough working with it, without making blatantly obvious mistakes

Just as there is no need to wear safety equipment when mountain-climbing, if you feel comfortable enough doing it without making blatantly obvious mistakes?

So just choosing an according path to save files, when you are reminded and warned in a dialog about this exact thing in testdisk, is the same as reaching the top of a mountain without safety equipment, while being in danger every second? Right.

Just as there's a need of wearing an IRON MAN suite while taking a walk in the park.

Still, I would not consider that to be good advice that helps encourage best practices in people who don't know any better.

[SquaL]

OP was already aware of cloning as can be seen from OP post on another thread. I think it is good idea to clone, and those new to data rec. will benefit from reminder. Obvious danger exist from cloning to working drive so care is needed. There is also possibility data rec sofware crash has bug, cause corruption to only copy, then what?

[northwind]

drc's comment was a reminder that when you mess with a failing drive you should always clone it first and then play safely.
XXL's comment was about recovering to the same sick drive (most s/w won't let you do that anyways).

I think hddguy is right, i'm puzzled too...

[Vulcan]

@northwind:

drc's comment was a reminder that when you mess with a failing drive you should always clone it first and then play safely.

Agreed

And even if a drive isn't thought to be failing (i.e. a "logical only" problem), then sometimes that is a mis-diagnosis (or incomplete diagnosis) by the user, and there really is a physical problem which the user was not aware of (I've identified that situation in several threads here, over the years). So then the drive is already at increased risk of further degradation, and cloning should be considered before attempting logical recovery IMHO.

We've seen several times on the forum where users have tried doing file-based recovery from their disk, and the disk has died after hours of recovery attempts. That time could have been time used for cloning, before the disk finally died too much for DIY and became a much more expensive professional recovery job.

[pcimage]

We ALWAYS make a clone before doing ANY logical work on a drive.

It's a matter of correct procedure....... "just in case"

"Belt and braces" maybe, but I don't want my trousers falling down!

[Vulcan]

I don't want my trousers falling down!

Thanks for that mental picture! Seriously though, completely agreed with that reasoning you described.

[northwind]

@Vulcan, totally agree.
I was only trying to clear the mixup in meanings.

[Vulcan]

@northwind,

Thanks, yes, I understand. Sorry if my posting wasn't clear - I was trying to agree with you, and add another example of what we have both said, based on my experiences

[northwind]

@Vulcan, no problem my friend. Sometimes writing to non-native language can cause this, sorry

[loki]

I don't want my trousers falling down!

Thanks for that mental picture! Seriously though, completely agreed with that reasoning you described.

I'm still in shock from that mental picture counselling is going to cost me a fortune


Loki

[jim]

Don't use the commercial recovery tools for Linux-file-systems.
Use the Linux tools. For ext3
http://extundelete.sourceforge.net/

[XXL]

Fascinating, how like the last 10 posts / posters are misinterpreting the context and going completely offtopic into something irrelevant to the OP's problem - only because of reckless reading that made them slip into a backup-tribute coma. He got 99 problems but a failing hard drive ain't one. He only wants to undelete / recover a deleted file. Therefore, he does not need to maniacally image his drive, unless he feels uncomfortable about somehow pressing the wrong set of keys - which is pretty hard to fluff up anyway, as testdisk presents you with a descriptive dialog and a warning, specifically for that exact thing (saving to a different storage). Lecturing about the importance of cloning is one thing, understanding the issue at hand and presenting a rational solution - is another. Imagine the redundancy, if he only needs to locate a single deleted file and is going to image a 2TB drive, just for that. Can speculate, that he might simultaneously have a failing hard drive, but what are the odds of that in this particular case? Pretty low. If it was really in such a bad shape - it would die regardless when being imaged or when testdisk would've had it's way with it: you either get an incomplete image or an array of recovered files. One is not much better than the other.

Also, it's not really testdisk, but photorec for the needed functionality.

[drc]

I have a case where customer has deleted data from linux ext3 file system.

(emphasis mine)

When dealing with data belonging to someone who is paying you and trusting their data to you, which is more important? Absolute safety, or saving a few minutes?