Ext3 restore data

I want to test some tools to restore deleted data on EXT3 file system, to make this tests safe on a production server without loosing date I created a virtual HDD with 100MB size that running as a file.

Create a 100MB virtual HDD:

1
2

dd if=/dev/zero of=virtual-hdd.img bs=1024 count=102400
# -rw-r--r-- 1 root root 104857600 Sep 20 09:27 virtual-hdd.img

That is not a real block device, but we ca proceed anyway with creation of a EXT3 filesystem on that virtual hdd:

1

mkfs.ext3 virtual-hdd.img

Create a mount point directry for your virtual HDD and mount it

1
2

mkdir mount-point
mount -o loop virtual-hdd.img mount-point && cd mount-point

Create pseudo files to delete them and finally restore:

1
2
3
4

echo 1234 > foo.txt
echo 5678 > bar.txt
echo important-file > pass.txt
mkdir foobar

Remove created files and directory:

1

rm -rf *

Umount your HDD and start to restore your data:

1

cd .. && umount mount-point

1

ext3grep --restore-all virtual-hdd.img

You will see a new directory “RESTORED_FILES” and your deleted files will be there.

Part II:
Extundelete is another powerful tool to restore data on ext3 and ext4 partitions – Get it!.

Compile it:
You need the “e2fslibs-dev” package to be able to compile it, else you will get an error: configure: error: Can’t find ext2fs library

1
2
3
4
5
6
7

aptitude install e2fslibs-dev
tar xfv extundelete-0.2.0.tar.bz2
cd extundelete-0.2.0
./configure
make
make install
/usr/local/bin/extundelete

Restore data with extundelete:

1

extundelete virtual-hdd.img --restore-all

Conclusion: extundelete was really fast but had problems to restore my empty directories.

Download extundelete from my mirror.

Part III:
ext4magic – recover deleted files on ext3/4 filesystems.