Recovery of deleted ext4 files
Restoring deleted files on the ext4 file system can be a difficult task, but in certain cases it is possible. Here are some methods that can help:
1. Using a data recovery program: There are many specialized programs for data recovery from various types of file systems, such as TestDisk or PhotoRec. They allow you to scan the disk and search for deleted data.
2. Checking the backup copy: If you made regular backup copies of your disk or a specific partition before deleting the file, you can simply return to the last saved point.
3. Using a journal: Files on ext4 are stored using a journaling file system, which means recording changes before physically updating the file structure on the disk.
– Method 1: Run command `sudo debugfs /dev/sdXY` where `/dev/sdXY` is your ext4 device/partition.
Then run the following commands:
“`
> lsdel
“`
This will display a list of all available inode index blocks with the value “deleted”.
“`
> logdump
“`
This will display a list of all log entries, including deleted files.
– Method 2: Execute command `sudo extundelete /dev/sdXY` where `/dev/sdXY` is your ext4 device/partition.
Then run the following command:
“`
sudo extenddelete –restore-all /dev/sdXY
“`
It is important to remember that the faster you take steps to recover data after its deletion, the greater the chances of successful recovery. In addition, it is recommended not to use the disk or partition with lost data until the recovery process is complete to prevent overwriting of information.
However, there is never a guarantee of complete and accurate recovery of data after deletion. Therefore, it is always better to have a backup copy of your valuable files before any modification operation on the disk or partitions of the Ext4 system file