On 26/10/2024 02:03, Hans wrote:
Am Freitag, 25. Oktober 2024, 20:32:29 CEST schrieb loulet...@sina.com:
Hi folksIs there possible to recover deleted files in ext4 filesystem?
Try extundelete.
[...]
Using an image, you can try nice tools like foremost, scalpel or autopsy to
recover files.
Also you can use CAINE, KALI or DEFT (these are forensis suites) for data
recovery.
Have you tried these tools in action? I believe that removing files from
ext4 wipes list of used blocks and explicitly zeroes size in inode
records, so a chance of recovery is quite low. Some info for recently
accessed files may be restored from filesystem journal. In the case of
contiguous block spans signature-based search (e.g. photorec from the
testdisk package) may find some files, but they will be buried in the
heap of false positives without any hints related to file names and
directory structures.
I am quite skeptical concerning fraction of successfully recovered files.
