zeldor.biz

Linux, programming and more

Copyright © 2023
Log in

Ext3 restore data

September 29, 2011 by Igor Drobot Leave a Comment

I want to test some tools to restore deleted data on EXT3 file system, to make this tests safe on a production server without loosing date I created a virtual HDD with 100MB size that running as a file.

Create a 100MB virtual HDD:

1
2
dd if=/dev/zero of=virtual-hdd.img bs=1024 count=102400
# -rw-r--r-- 1 root root 104857600 Sep 20 09:27 virtual-hdd.img

dd if=/dev/zero of=virtual-hdd.img bs=1024 count=102400 # -rw-r--r-- 1 root root 104857600 Sep 20 09:27 virtual-hdd.img

That is not a real block device, but we ca proceed anyway with creation of a EXT3 filesystem on that virtual hdd:

1
mkfs.ext3 virtual-hdd.img

mkfs.ext3 virtual-hdd.img

Create a mount point directry for your virtual HDD and mount it

1
2
mkdir mount-point
mount -o loop virtual-hdd.img mount-point && cd mount-point

mkdir mount-point mount -o loop virtual-hdd.img mount-point && cd mount-point

Create pseudo files to delete them and finally restore:

1
2
3
4
echo 1234 > foo.txt
echo 5678 > bar.txt
echo important-file > pass.txt
mkdir foobar

echo 1234 > foo.txt echo 5678 > bar.txt echo important-file > pass.txt mkdir foobar

Remove created files and directory:

1
rm -rf *

rm -rf *

Umount your HDD and start to restore your data:

1
cd .. && umount mount-point

cd .. && umount mount-point

1
ext3grep --restore-all virtual-hdd.img

ext3grep --restore-all virtual-hdd.img

You will see a new directory “RESTORED_FILES” and your deleted files will be there.

Part II:
Extundelete is another powerful tool to restore data on ext3 and ext4 partitions – Get it!.

Compile it:
You need the “e2fslibs-dev” package to be able to compile it, else you will get an error: configure: error: Can’t find ext2fs library

1
2
3
4
5
6
7
aptitude install e2fslibs-dev
tar xfv extundelete-0.2.0.tar.bz2
cd extundelete-0.2.0
./configure
make
make install
/usr/local/bin/extundelete

aptitude install e2fslibs-dev tar xfv extundelete-0.2.0.tar.bz2 cd extundelete-0.2.0 ./configure make make install /usr/local/bin/extundelete

Restore data with extundelete:

1
extundelete virtual-hdd.img --restore-all

extundelete virtual-hdd.img --restore-all

Conclusion: extundelete was really fast but had problems to restore my empty directories.

Download extundelete from my mirror.

Part III:
ext4magic – recover deleted files on ext3/4 filesystems.

Filed Under: Debian, Linux Tagged With: compile, ext2fs-dev, ext3, ext3grep, ext4, ext4magic, extundelete, filesystem ext3

Categories

Archives

Tags

apache2 Apple arduino ARM Automation backup bash Cisco Cluster Corosync Database Debian Debian squeeze DIY DNS Fedora FTP Fun Icinga Ipv6 KVM Linux LVM MAC OS X Monitoring MySQL Nagios Nginx openSUSE OpenVPN PHP Proxy Python python3 qemu RAID rsync Samba security ssh Ubuntu virtualization Windows Windows 7 Wordpress

Leave a Reply

Your email address will not be published. Required fields are marked *