2

I am trying to list deleted files from my ext3 file system. debugsfs command with -ld option , suppose to list deleted files but it only listing current existing files and folder. Is any alternate way without any third party tools to recover deleted files .

Thanks

vnix27
  • 856
  • 2
  • 11
  • 19

2 Answers2

1

Check out extundelete, application for undeleting files on ext3. Please note that in typical system there is rather many automatic write operations to disk, and probability for losing deleted files (as those disk areas are overwritten) is high.

Typically you want to remount your filesystem as read-only or boot from live-CD or similar to prevent overwriting, if you want to successfully restore any files.

Another maybe useful (but less so) link is this tutorial for recovering files. Method described in there is rather complex.

Olli
  • 768
  • 6
  • 16
  • I don't want to install any third party tool. – vnix27 Feb 15 '11 at 04:40
  • 2
    @vnix27: then you are basically out of luck. Of course you can use any tools for copying data from raw device (for example /etc/sda), but just finding right place will be problematic. – Olli Feb 15 '11 at 11:32
  • 1
    @vnix27 extundelete is in the (Ubuntu, at least) repos, why don't you want to install it? (and debugsfs isn't) – Kevin Nov 02 '11 at 21:33
0

You could also try photorec from CGSecurity. It tries to recover every stream it can detect. But you can't select files out of the restore process.

http://www.cgsecurity.org/wiki/PhotoRec

patricks
  • 278
  • 2
  • 12