TestDisk: undelete file for ext2

From CGSecurity
Jump to navigation Jump to search

En.png English De.png Deutsch Ro.png Română


This Recovery example guides you through TestDisk step by step to undelete files from ext2 filesystem. The ext2 or second extended file system is a file system for the Linux kernel.

Start the undelete process

  • Select Advanced
Ext2 select advanced.png


  • Select the partition that was holding the lost files and choose Undelete
Ext2 select undelete.png


ext2 file undelete

Navigate in the directory structure until you have found the directory that was holding the file you are trying to recover. Deleted files are displayed in red. To undelete a file, select the file to recover and press 'c' to copy the file

Ext2 undelete select file.png


Select where recovered files should be written

Select the destination

Ext2 undelete copy.png


Recovery is completed

Once the ext2 file recovery completed, choose Quit.

Ext2 undelete done.png


For maximum security, TestDisk doesn't try to unerase files but let you copy the deleted files on another partition or disk. Remember you must avoid writing anything on the file system that was holding the data - otherwise deleted files may be overwritten by new ones.

TestDisk can undelete

If a lost file is still missing, give PhotoRec a try. PhotoRec is a signature based file recovery utility and may be able to recover your data where other methods failed. Note that it can recover deleted files from ext3 and ext4 filesystem.