Re: data recovery tools for debian (command line)
On Thu, 2012-05-10 at 17:32 +0500, Muhammad Yousuf Khan wrote:
> > For what file systems?
>
> any, ext2, 3 or 4 . just asked in general perspective. so instead of
> reading all the material on the net and filter out the garbage which
> is very time consuming. so just to make my studies time efficient and
> other like me also get some help as well.
Parted Magic is a good live media to use.
On Parted Magic there are command line tools such as ext3grep and
extundelete and others.
Mount the partition, where you deleted files as read only first. The
recovered data will be written to another partition. Any writing to the
partition with the deleted folders and files can overwrite important
directory entries and/or data. Note, even reading can cause a write,
IIRC e.g. if you don't mount with noatime, the last read access will be
written to a file.
I don't have all those commands and options in mind, but take care to
use options that will recover the data in a human readable/usable
format. IOW you'll get "/my_dir/my_file_a /my_dir/my_file_b" etc. and
not "no_dir_cryptic_filename_a no_dir_cryptic_filename_b".
They also have got options to recover data that is from a special time
etc..
All those tools for ext3 come with patches, they are usable for ext4,
theoretically. In practice 99% of your data will be lost.
I still have 2 unmounted ext4 partitions since December 2011. I nearly
couldn't recover anything, but sure, I got back some data.
I experienced recovering partition tables as working 100% perfect. If
there are errors on a HDD I experienced fsck -fcyv, fsck -f -y etc. as
working properly too.
You should read howtos. Use links e.g. given from an updated Wiki, the
home page of the current version of your recovery live media you're
using etc.. You never know if there won't be new tools or important
changes.
Hth,
Ralf
Reply to: