2

I am trying to list deleted files from my ext3 file system. debugsfs command with -ld option , suppose to list deleted files but it only listing current existing files and folder. Is any alternate way without any third party tools to recover deleted files .

Thanks

2 Answers 2

1

Check out extundelete, application for undeleting files on ext3. Please note that in typical system there is rather many automatic write operations to disk, and probability for losing deleted files (as those disk areas are overwritten) is high.

Typically you want to remount your filesystem as read-only or boot from live-CD or similar to prevent overwriting, if you want to successfully restore any files.

Another maybe useful (but less so) link is this tutorial for recovering files. Method described in there is rather complex.

3
  • I don't want to install any third party tool.
    – vnix27
    Feb 15, 2011 at 4:40
  • 2
    @vnix27: then you are basically out of luck. Of course you can use any tools for copying data from raw device (for example /etc/sda), but just finding right place will be problematic.
    – Olli
    Feb 15, 2011 at 11:32
  • 1
    @vnix27 extundelete is in the (Ubuntu, at least) repos, why don't you want to install it? (and debugsfs isn't)
    – Kevin
    Nov 2, 2011 at 21:33
0

You could also try photorec from CGSecurity. It tries to recover every stream it can detect. But you can't select files out of the restore process.

http://www.cgsecurity.org/wiki/PhotoRec

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .