Tell us about real cases of recovering deleted files from ext3?

Question

linux

Good evening, hackers!
Deleted a valuable file from an ext3 partition. The disk is alive without problems. Not fatal, but there was reason to think.
Accordingly, 2 questions
1. Can I restore the file myself?
2. Which fs is the most attractive in terms of recovering deleted files.
Please tell us about real cases.
Thanks in advance.
PS There is no need to remind about backups, this is not a panacea.

Answer 1

Backups are just a panacea - start doing them already.

Answer 2

Used PhotoRec
File systems that work with
FAT,
NTFS,
EXT2/EXT3 filesystem
HFS+
Well, the list of file formats that you can try to recover.

Answer 3

Really restored, but the main minus was the unmonitoring of the FS, moreover, with vend programs.
since there was a site on Joomla on the server, there was a photo gallery on gallery2, there was a bridge between them, but the bridge, without notifying me, moved everything to the Joomla directory in the components folder and all the gallery files moved there, and I continued to think that they were in gallery2
and then somehow demolished jumla, actually and a photo gallery of a network of a whole, small one.
It was a shame, I didn’t restore it because I had to take it offline, and I also had to get into the server room.
I don't agree about backups.
in an organization on a network file system, a recycle bin is configured, it is not visible to the user, but visible to me, and all deleted files are added there. for a couple of years, a dozen times, users have definitely come running with a gray head, they say the file is gone, the folder is gone.
3 hours before project completion.
so it's better not to mess around and make backups of important data in the same dropbox.
and of course it’s not a panacea, not at all, it’s easier to restore a deleted file if you succeed than to take the desired file from a gentle and cozy storage

Answer 4

at one time, the testdisk utility saved a lot , the ntfs file system was.

Answer 5

I remember I erased the file on which I worked for a couple of days (I'm a programmer). The file has not been committed to version control, i.e. there were no copies. The file was small, somewhere around 1 kb or even less, but vigorous - I worked on the code a lot.
Poking around with the utilities scored on them. I remembered a couple of characteristic long variable names from the erased file, such as latest_stn_check_date, wrote a program in C that opens and reads / dev / hda1 sectors (I don’t remember exactly which screw was there) from beginning to end in search of a line with a variable name. The found data is saved to a file.
In general, I unpicked the file and restored it. It took about a couple of hours.

Answer 6

Used at one time www.sleuthkit.org/

Answer 7

Used a scalpel. Something has been restored.

Answer 8

restored, now everything can be done quite automatically, it is guaranteed that something cannot be restored.
The best system for restoring versioned backup files.

Answer 9

I often worked with restoring different FS, but so far I haven’t had the task of restoring a single file from the FS itself to ext3 - I always had backups at hand. The most adapted system for recovering single files and folders is IMHO VSS (aka ShadowCopy).

Answer 10

I use btrfs, I take pictures =) And important data on a pair of virtual servers / external media. At one time, I ditched the data on ext3 (not the obvious "rm -rf / *"), fortunately I did not have time to overwrite it. The recovery was very effective, but the system could not be restored to working condition (and there is little point in restoring, backups are needed).

Answer 11

Recently used extundelete.sourceforge.net/ quite successfully , restored a lot of things

Answer 12

1. You can recover it yourself using R-Studio: www.r-tt.com/data_recovery_linux/
2. alas, I don't know. I can definitely say that ext2 / ext3 is better than less popular file systems, for example, ZFS. But on ZFS and backups are much easier to do.