TestDisk: undelete file for ext2
From CGSecurity
This Recovery example guides you through TestDisk step by step to undelete files from ext2 filesystem. The ext2 or second extended filesystem is a file system for the Linux kernel.
Start the undelete process
- Select Advanced
![]() |
- Select the partition that was holding the lost files and choose Undelete
![]() |
ext2 file undelete
Navigate in the directory structure until you have found the directory that was holding the file you are trying to recover. Deleted files are displayed in red. To undelete a file, select the file to recover and press 'c' to copy the file
![]() |
Select where recovered files should be written
Select the destination
![]() |
Recovery is completed
Once the ext2 file recovery completed, choose Quit.
![]() |
For a maximum of security, TestDisk doesn't try to unerase files but let you copy the deleted files on another partition or disk. Remember you must avoid to write anything on the filesystem that was holding the data, otherwise deleted files may be overwritten by new ones.
TestDisk can undelete
- files from ext2 filesystem,
- files from NTFS partition since version 6.11,
- files and directory from FAT12, FAT16 and FAT32 filesystem.
If a lost file is still missing, give PhotoRec a try. PhotoRec is a signature based file recovery utility and may be able to recover your data where other methods failed. Note that it can recover deleted files from ext3 and ext4 filesystem.