I want to test some tools to restore deleted data on EXT3 file system, to make this tests safe on a production server without loosing date I created a virtual HDD with 100MB size that running as a file.
Create a 100MB virtual HDD:
dd if=/dev/zero of=virtual-hdd.img bs=1024 count=102400 # -rw-r--r-- 1 root root 104857600 Sep 20 09:27 virtual-hdd.img
That is not a real block device, but we ca proceed anyway with creation of a EXT3 filesystem on that virtual hdd:
Create a mount point directry for your virtual HDD and mount it
mkdir mount-point mount -o loop virtual-hdd.img mount-point && cd mount-point
Create pseudo files to delete them and finally restore:
1 2 3 4
echo 1234 > foo.txt echo 5678 > bar.txt echo important-file > pass.txt mkdir foobar
Remove created files and directory:
rm -rf *
Umount your HDD and start to restore your data:
cd .. && umount mount-point
ext3grep --restore-all virtual-hdd.img
You will see a new directory “RESTORED_FILES” and your deleted files will be there.
You need the “e2fslibs-dev” package to be able to compile it, else you will get an error: configure: error: Can’t find ext2fs library
1 2 3 4 5 6 7
aptitude install e2fslibs-dev tar xfv extundelete-0.2.0.tar.bz2 cd extundelete-0.2.0 ./configure make make install /usr/local/bin/extundelete
Restore data with extundelete:
extundelete virtual-hdd.img --restore-all
Conclusion: extundelete was really fast but had problems to restore my empty directories.
ext4magic – recover deleted files on ext3/4 filesystems.