"Need help recovering Ext4 file. I wrote a script that seemingly ended up running "rm -rf *" on the root directory. Even my backup drive that was connected at that moment was totally wiped. Everything gone, textbook worst-case scenario. " - Post on Reddit
This is a nightmare scenario for any Linux user, losing valuable data due to a simple mistake. Accidents happen in this digital age, and it's crucial to know how to recover lost files. Whether you're a professional or a novice, this guide will give you the knowledge and resources to undelete files on the EXT4 partition successfully.
Part 1. EXT4 File System Overview
EXT4, the fourth extended file system, is a file system for Linux-based operating systems. It is an evolution of the previous EXT3 file system and was first introduced in August 2008.
The EXT4 file system offers several improvements over its predecessor, including increased maximum file and file system size, improved performance, and extended attributes. Some of the key features of EXT4 include support for multi-block allocation, improved journaling, and support for extents.
It also includes several performance enhancements, such as delayed allocation and online defragmentation. Additionally, it offers improved data integrity and reliability.
Part 2. How Is the EXT4 File System Designed to Protect Data?
EXT4 file system is designed with a few key features that help protect your data.
Inode Tables
An inode table is a data structure that stores information about each file and directory on the file system. Each file and directory on the file system has a unique inode number, which is used to reference the corresponding entry in the inode table.
The inode table stores information about the file or directory, such as its owner, permissions, timestamps, and block location on the file system. Each partition has its own set of inode numbers. These inode numbers are unique within the partition and are used to identify and locate files and directories on the partition.
It is important to note that if the number of inodes allocated at the time of partition creation is exceeded, it will not be possible to create new files, even if there is free space on the partition.
Journaling
Journaling is a technique used in file systems to ensure data consistency and integrity in case of system crashes or power failures. In the EXT4 file system, journaling is implemented through a journaling feature known as the Ext4 journal.
The journal is a special file system area that records metadata changes before they are committed to the main file system. This allows the file system to quickly recover from crashes or power failures by replaying the journal and restoring the file system to a consistent state. The journal also allows for faster file system check and repair operations.
Part 3. 3 Ways to Recover Deleted Files on EXT4 File System
Way 1: EXT4 File Recovery Using Recoverit (GUI Tool)
Wondershare Recoverit is a GUI data recovery tool that offers a user-friendly interface and the ability to recover lost, deleted, or overwritten files on various file systems, including EXT4 on Linux. It has several features specifically designed for deleted file recovery, including
Wondershare Recoverit - Your Safe and Reliable Data Recovery Software
5,481,435 people have downloaded it.
Recovers lost or deleted documents, photos, videos, music, emails, and other 1000+ file types effectively, safely, and completely.
Supports all popular file systems, including FAT32, exFAT, NTFS, APFS, EXT4, BTRFS, and many more.
Assists in 500+ data loss scenarios, such as deletion, disk formatting, OS crash, power outage, virus attack, lost partition, etc.
Supports data recovery from 2000+ storage devices, including Windows/Mac/Linux PCs, USB drives, SD cards, NAS servers, digital cameras, etc.
View the video tutorial below to learn how to undelete files from an EXT4 partition on Linux using Recoverit Linux Recovery. A step-by-step guide is also available below.
For Windows Vista/7/8/10/11
For macOS X 10.10 or later
Step 1: Download and install Wondershare Recoverit on your PC. Launch the program and select the NAS and Linux option from the navigation panel. Click on the Linux Recovery button to begin the EXT4 file recovery process.
Step 2: You will be prompted to enter the credentials to establish a remote connection between the data recovery software and your Linux device. Once all the required information is entered, click on the Connect button. The software will establish a connection and begin the scan process.
Once the connection is established, Recoverit will automatically scan the Linux computer for lost files.
Step 3: Let the scan finish. If you find the desired file while the scan is still in progress, you can end the scan by clicking the Stop icon. This allows you to quickly restore the necessary file and avoid waiting for the entire scan to finish. You can preview the files to make sure they are the desired ones.
Step 4: Select the files you are looking for and click the Recover button to save all needed files to a safe location.
Way 2: EXT4 File Recovery Using Extundelete (GLI Tool)
Extundelete is a command-line utility that allows users to recover deleted files from a partition or a disk that uses the EXT3 or EXT4 file system. It can recover individual files or entire directories that were accidentally deleted or lost due to a system crash or other failure.
Extundelete is an open-source application, which means that the source code is publicly available and can be modified by users.
To recover a specific file from an EXT4 device using Extundelete, you can utilize the following command:
Step 1: Install Extundelete on your Linux computer using the command:
- For Ubuntu and Debian
sudo apt install extundelete
- For RHEL and CentOS
sudo yum install extundelete
- For Arch Linux
sudo yay -S extundelete
Step 2: Once Extundelete is installed, it can recover deleted files from a Linux system. To swiftly restore a particular file, execute the following command. It is crucial to remember that the file path must be specified relative to the partition's root.
sudo extundelete --restore-file picture.jpg /dev/sdb1
Way 3: EXT4 File Recovery Using ext4magic (GLI Tool)
Ext4magic is a disk utility tool that can recover deleted files from an EXT4 file system. Ext4magic can retrieve information from the journal and restore files in a directory tree as long as the journal contains sufficient information.
This tool can recover various file types, preserving their original filenames, ownership, group, file permissions, and timestamps.
To recover the lost files from EXT4 using Ext4magic, follow the steps:
Step 1: Immediately after deleting, open a terminal and use the command below to make a copy of the filesystem journal.
sudo debugfs -R "dump <8> /opt/sda6.journal"/dev/sda6
Replace /dev/sda6 with the appropriate path to your device. Do not store the copy in the /tmp directory.
Note: Close any programs writing to the same partition to minimize system interactions and prevent the blocks containing the deleted files from being overwritten.
Step 2: Install ext4magic to recover files from ext3 or ext4 partitions.
sudo apt-get install ext4magic
Step 3: To access the root user and unmount a partition for processing, reboot the system and select Advanced options from the grub screen.
Step 4: Pick the option for recovery mode and select Enable networking from the recovery mode menu. This enables networking and mounting all file systems defined in /etc/fstab and may take several minutes to complete.
If the interface becomes buggy, use Enable networking to continue the process. As the Enable networking process completes, select the root shell option from the menu, which should now display read/write mode at the top.
Step 5: In the root shell, unmount the partition where the deleted files were located initially: umount /home. Run ext4magic on the partition:
ext4magic /dev/sda6 -a $(date -d "-6hours" +%s) -f user/folder -j /opt/sda6.journal -l
Step 6: In the left column of the output, all files with 100% should be recoverable. To recover the files, run the following command:
A:/dev/sda6 ext4magic -a 1332606716 -f user/folder -j /tmp/sda6.journal -r -d /opt/RECOVER
Exit the Root shell and choose resume from the menu.
Note: If the tool recovers some unwanted files, delete them.
A tip: When ext4magic outputs files with less than 100%, use the -m option rather than the -r option since a lengthier process may be able to recover the files. However, it doesn’t promise any guarantee.
Conclusion
Restoring deleted files from EXT4 partitions is easy if you have the right tools and knowledge. Fortunately, it's now easier than ever to undelete those essential files that were accidentally deleted, thanks to excellent recovery utilities like Extundelete and Wondershare Recoverit.