TestDisk: undelete file for ext2

From CGSecurity

Jump to: navigation, search

This Recovery example guides you through TestDisk step by step to undelete files from ext2 filesystem. The ext2 or second extended filesystem is a file system for the Linux kernel.

Start the undelete process

  • Select Advanced
Image:ext2_select_advanced.png
  • Select the partition that was holding the lost files and choose Undelete
Image:ext2_select_undelete.png

ext2 file undelete

Navigate in the directory structure until you have found the directory that was holding the file you are trying to recover. Deleted files are displayed in red. To undelete a file, select the file to recover and press 'c' to copy the file

Image:ext2_undelete_select_file.png

Select where recovered files should be written

Select the destination

Image:ext2_undelete_copy.png

Recovery is completed

Once the ext2 file recovery completed, choose Quit.

Image:ext2_undelete_done.png

For a maximum of security, TestDisk doesn't try to unerase files but let you copy the deleted files on another partition or disk. Remember you must avoid to write anything on the filesystem that was holding the data, otherwise deleted files may be overwritten by new ones.

TestDisk can undelete

If a lost file is still missing, give PhotoRec a try. PhotoRec is a signature based file recovery utility and may be able to recover your data where other methods failed. Note that it can recover deleted files from ext3 and ext4 filesystem.

Data Recovery
Security