How to Recover Deleted Files in Linux Ext3

The ext3 file system is the major player in Linux file system types. Like all file systems, ext3 does not have an undelete feature and requires that permanently deleted files be recovered through a piece of forensic software. The only software available for the Linux operating system that can accomplish this is PhotoRec, a tool originally built for recovering pictures off damaged flash media.

• 1

  Download and install PhotoRec using your distribution's package management utility. Most of the time, you will find it packaged with TestDisk, from the same developer. TestDisk is a similar tool for recovering deleted partitions.

• 2

  Create a folder to store your recovered files. You should do this on a separate partition. It may be best to use an external medium or network drive, since writing to the partition PhotoRec is recovering from can cause problems.

• 3

  Launch a terminal window and use the "su" command to gain a root shell. If you are using a system like Ubuntu or have the sudo package installed, you can simply type "sudo photorec" instead of using "su" and then typing "photorec" to launch the application from the root shell.

• 4

  Select the hard drive you want to recover from the list and press "Enter." PhotoRec will automatically detect the partition table type, but double-check before pressing "Enter" on the next screen. Select the partition you want to recover files from and press "Enter" to continue. Optionally, you can use the "FileOpts" dialog to select the specific file types you wish to recover, such as text documents or video files.

• 5

  Select the file system type "ext3" from the next screen and press the "Enter" key. Select the "Free" option if only want to search the unallocated space on the hard drive, or select the "Whole" option to search every possible bit for recovery. Press "Enter" to continue.

• 6

  Select where you want to store the files once they are recovered, then press "Y" to begin. Make sure that the recovery point is not on the same partition you are recovering from. Press "Enter" once PhotoRec completes the recovery, then select "Quit" to exit the program.