Thursday, June 4, 2009

Rescue Files from Linux ext2/ext3 partitions

Last night, after restoring my EeePC to the recently downloaded 1.6 iso, I suddenly remembered that my recently written scripts are still in the USER partition (sda2). So I tried to rescue the scripts, and here is what I did (though not successful this time).

There is a free file recovery utility for the Ext2FS/Ext3FS file system called R-Linux which runs in Microsoft Windows. I use to use this to recover files when I accidentally delete some files from my ext2/ext3 partitions of my desktop. So the pre-requisite to use R-Linux is to have a Windows desktop with R-Linux installed. And of course, you should not write anything to the partition you want to recover files from, so you will need to boot from another OS and dump the partition data. What I did is to boot from Pupeee and dd the complete sda2 partition (hdc2 in Pupeee) to a partition in a SD card.
dd if=/dev/hdc2 of=/dev/sdb2 conv=notrunc,noerror
Then I took the SD card to my Windows desktop and scan it with R-Linux.

Here is the "Drive View" at startup of R-Linux. The SD card is recognised as "Disk23", and "Partition1" is the duplicated sda2 from my EeePC.

Next, I select "Disk23" - "Partition1" and click on the [Scan] button.

The program will then scan all inodes for available filesystems. You can see from the screenshot that it will find all filesystems/partitions, some even dated back to (last written) 2008. But only "Recognised0" (the latest modified filesystem) contain valid files that can be recovered.

If you are lucky enough, the files have not been overwritten, then you can simply select them and click on the [Recover] button. The program will then ask you what to save your files, and then you are done.

If you can't find the file you want, you can still use the [Search] function if you can remember the filename. The program also support some advanced search function like searching for last modified date, etc. Basically, R-Linux is very user friendly and useful to recover files from ext2/ext3 partitions.

No comments:

Post a Comment