- \n
- Device name:\u00a0\/dev\/sdb1<\/strong><\/li>\n
- Mount point:\u00a0\/mnt\/TEST_DRIVE<\/strong><\/li>\n
- Filesystem type:\u00a0EXT3<\/strong><\/li>\n<\/ul>\n
How to Recover Deleted Files Using ext3grep Tool<\/h3>\n
To\u00a0recover deleted files<\/a>, first you need to install\u00a0ext3grep<\/strong>\u00a0program on your Ubuntu or Debian system using\u00a0APT package manager<\/a>\u00a0as shown.<\/p>\n
$ sudo apt install ext3grep\r\n<\/pre>\n
Once installed, now we will demonstrate how to recover deleted files on a ext3 filesystem.<\/p>\n
First, we will create some files for testing purpose in the mount point\u00a0
\/mnt\/TEST_DRIVE<\/code>\u00a0of the ext3 partition\/device i.e.\u00a0\/dev\/sdb1<\/code>\u00a0in this case.<\/p>\n$ cd \/mnt\/TEST_DRIVE\r\n$ sudo touch files[1-5]\r\n$ ls -l\r\n<\/pre>\n
\n![\"Create](\"https:\/\/www.tecmint.com\/wp-content\/uploads\/2019\/01\/Create-Testing-Files.png\")
<\/a><\/p>\nCreate Files in Mount Point<\/p>\n<\/div>\n
Now we will remove one file called\u00a0
file5<\/code>\u00a0from the mount point\u00a0\/mnt\/TEST_DRIVE<\/code>\u00a0of the ext3 partition.<\/p>\n$ sudo rm file5\r\n<\/pre>\n
\n![\"Remove](\"https:\/\/www.tecmint.com\/wp-content\/uploads\/2019\/01\/remove-a-file.png\")
<\/a><\/p>\nRemove a File in Linux<\/p>\n<\/div>\n
Now we will see how to recover deleted file using\u00a0ext3grep<\/strong>\u00a0program on the targeted partition. First, we need to unmount it from the mount point above (note that you have to use\u00a0cd command<\/a>\u00a0to switch to another directory for the unmount operation to work, otherwise the\u00a0umount<\/strong>\u00a0command will show the error \u201cthat target is busy<\/strong>\u201c).<\/p>\n
$ cd\r\n$sudo umount \/mnt\/TEST_DRIVE\r\n<\/pre>\n
Now that we have deleted one of the files (which we\u2019ll assume was done accidentally), to view all the files that existed in the device, run the\u00a0
--dump-name<\/code>\u00a0option (replace\u00a0\/dev\/sdb1<\/code>\u00a0with the actual device name).<\/p>\n$ ext3grep --dump-name \/dev\/sdb1\r\n<\/pre>\n
\n![\"View](\"https:\/\/www.tecmint.com\/wp-content\/uploads\/2019\/01\/view-all-files-that-existed-in-ext3-partition-before-deletion.png\")
<\/a><\/p>\nView Files on Partition<\/p>\n<\/div>\n
To recover the above deleted file i.e.\u00a0
file5<\/code>, we use the\u00a0--restore-all<\/code>\u00a0option as shown.<\/p>\n$ ext3grep --restore-all \/dev\/sdb1\r\n<\/pre>\n
Once the recovery process is complete, all recovered files will be written to the directory\u00a0RESTORED_FILES<\/strong>, you can check if the deleted file is recovered or not.<\/p>\n
$ cd RESTORED_FILES\r\n$ ls \r\n<\/pre>\n
\n![\"Recover](\"https:\/\/www.tecmint.com\/wp-content\/uploads\/2019\/01\/restore-deleted-file.png\")
<\/a><\/p>\nRecover a Deleted File<\/p>\n<\/div>\n
We may specify a particular file to recover, for example the file called\u00a0
file5<\/code>\u00a0(or specify the full path of the file within the ext3 device).<\/p>\n$ ext3grep --restore-file file5 \/dev\/sdb1 \r\nOR\r\n$ ext3grep --restore-file \/path\/to\/some\/file \/dev\/sdb1 \r\n<\/pre>\n
In addition, we can also restore files within a given period of time. For example, simply specify the correct date and time frame as shown.<\/p>\n
$ ext3grep --restore-all --after `date -d 'Jan 1 2019 9:00am' '+%s'` --before `date -d 'Jan 5 2019 00:00am' '+%s'` \/dev\/sdb1 \r\n<\/pre>\n
For more information, see the ext3grep man page.<\/p>\n
$ man ext3grep\r\n<\/pre>\n
That\u2019s it!\u00a0ext3grep<\/strong>\u00a0is a simple and useful tool to investigate and recover deleted files on an ext3 filesystem. It is one of the the best programs to recover files on Linux. If you have any questions or any thoughts to share, reach us via the feedback form below.<\/p>\n
- Mount point:\u00a0\/mnt\/TEST_DRIVE<\/strong><\/li>\n