LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - General (https://www.linuxquestions.org/questions/linux-general-1/)
-   -   Recover formatted ext3 partition files (https://www.linuxquestions.org/questions/linux-general-1/recover-formatted-ext3-partition-files-465026/)

mazzo 07-17-2006 08:42 PM

Recover formatted ext3 partition files
 
I've completely fluffed up my drive when trying to install another distro onto one of my partitions. Even though I gave the correct drive (hdb2) it installed over my /home partition (hda2).

I have backed up but not for about a month and I could really do with trying to get some files off it. I realise that there are going to be some that are lost forever, but it was a big partition and only a small bit has been written to it - so I am hopeful of some.

Can anyone advise how to do it simply, whether there are any decent tools out there that don't cost the earth - and what my chances are ;)

Thanks

PS: tried R-Linux but couldn't seem to get any sensible results.

mickyg 07-18-2006 03:42 AM

Well as you suggest some of your files are probably gone forever, however, I have heard that apparently files can actually be retrieved from a hard drive even if they've been over-written many times - I'm not too sure just how true that is, but you might want to have a look at security distributions such as Knoppix-STD and the Auditor distro to see if they have any tools that might help you.

doc.nice 07-18-2006 03:52 AM

good luck, I tried to recover deleted files on a ext3 drive some month ago and had to learn that compared to ext2 (non-journaling) this is nearly impossible.
but you may try using autopsy and elocker (google is your friend)

HTH,
Flo

mazzo 07-18-2006 05:58 AM

Thanks. I hadn't thought of Knoppix STD. Looked at it years ago and thought I'd never need/use it. Need to get familiar with some of the tools.

I am not sure how ext3 saves files, whether it fragments them, puts them all in order from the start of the position - filling space as it goes along, or (as I am hoping) spews them all over the disk but complete.

I am not overly hopeful, but there must be decent reasons for migrating to ext3 than ext2 - just hope it benefits recovery.

Thanks again.

michapma 07-18-2006 06:56 AM

Try it out:
http://www.cgsecurity.org/wiki/PhotoRec

I used it recently with much success on an 80-GB NTFS partition. ext3 is listed. A surprisingly large amount of file formats are supported. Its main strength is photo files, it won't get everything, and you'll also get garbage, but it works well for many types and is an open-source tool.

The most recent version of Knoppix (5.0.1) has its sister program TestDisk version 6.3-1, but apparently not PhotoRec. The most recent version is the 6.4 release.

mazzo 07-19-2006 03:29 AM

I had tried photorec - which did pull some files out - but they were fragmented "bits". It did pull out jpegs well! I wanted something that got me my mail and documents back.

I have made an image of the drive and can grep for certain things. Some I find and others not, but getting them off is another thing.

Most recover programs - even though they are ext2/3 specific - tend to concentrate on .doc .xls etc and not .sxw (openoffice type) docs. They are also good at finding Outlook Express mail files - but not mbox or Evolution type. Seems odd that someone would even have OE on an ext3 file system.

Try as hard as I could, I could not get foremost to work. That looked my best bet as it seems you can create file masks for it to search - which with some reading and playing I might have got there - but it would not work (this was the version in the Knoppix STD)


So, I guess my questions now are:

If I can grep certain files, how can I easily get them back?

Are there other progs that could get back mbox / evolution files?

Will my wife ever speak to me again????

syg00 07-19-2006 04:24 AM

I went to a presentation on pyflag at LCA in NZ. It's more designed for forensic analysis rather than recovery, but it can certainly handle M$soft mail systems, so hopefully also Linux ones.
Files can be individually selected for saving, don't know about bulk saving.

You should find it on sourceforge I would think - check it out.

mariapeter12 07-01-2010 11:27 PM

Ext3 recovery
 
Quote:

Originally Posted by doc.nice (Post 2339037)
good luck, I tried to recover deleted files on a ext3 drive some month ago and had to learn that compared to ext2 (non-journaling) this is nearly impossible.
but you may try using autopsy and elocker (google is your friend)

HTH,
Flo

I guess u need some Ext3 Recovery software

archtoad6 07-02-2010 03:35 AM

Quote:

Originally Posted by mariapeter12 (Post 4021263)
I guess u need some Ext3 Recovery software

Any suggestions? ...

pixellany 07-02-2010 08:36 AM

Quote:

Originally Posted by mariapeter12 (Post 4021263)
I guess u need some Ext3 Recovery software

Please do not dig up old threads and then post something like this which adds no useful information.


All times are GMT -5. The time now is 11:58 PM.