On Sat, Oct 26, 2024 at 09:57:11AM +0700, Max Nikulin wrote: > On 26/10/2024 02:03, Hans wrote: > > Am Freitag, 25. Oktober 2024, 20:32:29 CEST schrieb loulet...@sina.com: > > > Hi folksIs there possible to recover deleted files in ext4 filesystem? > > > > Try extundelete. > [...] > > Using an image, you can try nice tools like foremost, scalpel or autopsy to > > recover files. > > > > Also you can use CAINE, KALI or DEFT (these are forensis suites) for data > > recovery. > > Have you tried these tools in action? I believe that removing files from > ext4 wipes list of used blocks and explicitly zeroes size in inode records, > so a chance of recovery is quite low. Some info for recently accessed files > may be restored from filesystem journal. In the case of contiguous block > spans signature-based search (e.g. photorec from the testdisk package) may > find some files, but they will be buried in the heap of false positives > without any hints related to file names and directory structures.
I actually tried photorec a while ago. It uses heuristics to guess which free blocks to stitch together and it's not *that* bad. But: you have to be quick (the more you use your file system the worse your recovery chances), you need *a lot* of extra storage (there's more than one way to stitch a junkyard together) and you'll have to wade through quite a bit of stuff. And oh, it takes quite a bit of time to chew through a file system. Cheers -- t
signature.asc
Description: PGP signature
