# How to undelete removed files and directories on an ext3 file system



## lotuseclat79 (Sep 12, 2003)

While exploring the issue of recovering accidentally deleted files from my ext3 journalized file system, and not wanting to pay for any tools (although there are tools that are free to use if you register, but may not focus specifically on file recovery), I found the following web page that describes the details of recovering a removed file from an ext3 journalized file system - just what I wanted to know.

Be forewarned - this document is advanced, and so, beginners and intermediates beware.

HOWTO recover deleted files on an ext3 file system.

Also, I found the diagrams in this PDF document useful: Taking advantage of Ext3 journaling file system in a forensic investigation.

-- Tom


----------



## RootbeaR (Dec 9, 2006)

More for newbies like me:
"Recover Deleted Files with Foremost"
http://tuxtraining.com/2008/04/10/recover-deleted-files-with-foremost


----------



## lotuseclat79 (Sep 12, 2003)

After downloading the tool (ext3grep) referenced at the end of post #1 in this thread, configuring it depended on the e2fslibs-dev and comerr-dev packages being installed - Synaptic Package Manager was used after checking off universe and multiverse repository settings and clicking on the reload icon.

Essentially, compiling the ext3grep tool contained a Makefile bug, and required cd'ing down the directory hierarchy of the src directory, and executing the make command at the lowest level there after which make check and sudo make install were successfully executed to create and install the ext3grep executable in /usr/local/bin.

Unfortunately, the only documentation was to use the command itself's, $ ext3grep --help, output and the makeinfo doc apparently didn't make it. I think the missing command needed to have the makeinfo parameter to touch the file makeinfo. I need to experiment with it to see if I can get the info documentation if it exists.

This command, ext3grep, is worth experimenting with a test directory (backedup of course) with several small files (probably text files) to delete and see if you can recover from its hard disk (ext3 journaled file system).

Naturally, I prefer this kind of tool which is a finer-grain tool than the course-grain tool, Foremost, referenced in post #2 of this thread by RootbearR. Foremost dumps by file type everything it can recover in the same output directory it creates.

I want to see if ext3grep can recover a deleted directory, and its contents which is arguably a more focused (meaning less cruft files recovered which you don't care about) approach to accidentally deleted directories and files contained therein (in which you have a more vested interest).

-- Tom


----------



## lotuseclat79 (Sep 12, 2003)

In addition to Foremost, there is also another tool name Scapel. See the PDF file about both here.

Resource Info from article:
[1] The Coroner's Toolkit: http://​www.​porcupine.​org/​forensics/​tct.html
[2] The Sleuth Kit: http://​www.​sleuthkit.​org
[3] Foremost: http://​foremost.​sf.net
[4] Scalpel: http://​www.​digitalforensicssolutions.com/​Scalpel/
[5] PhotoRec: http://​www.​cgsecurity.org/​wiki/​PhotoRec
[6] FTimes: http://​ftimes.​sourceforge.​net/FTimes/
[7] Foremost on the Forensics Wiki: http://www.forensicswiki.org/wiki/Foremost
[8] OCFA, The carve path zero-storage library and filesystem: http://ocfa.sourceforge.net/libcarvpath/
[9] DFRWS carving challenge: http://​www.​dfrws.​org/​2006/​challenge/

-- Tom

Ref: Carving tools help you recover deleted files: UNDELETED.
Author(s): Ralf Spenneberg

Modern filesystems make forensic file recovery much more difficult. Tools like Foremost and Scalpel identify data structures and carve files from a hard disk image.

IT experts and investigators have many reasons for reconstructing deleted files. Whether an intruder has deleted a log to conceal an attack or a user has destroyed a digital photo collection with an accidental rm ‑rf, you might someday face the need to recover deleted data. In the past, recovery experts could easily retrieve a lost file because an earlier generation of filesystems simply deleted the directory entry. The meta information that described the physical location of the data on the disk was preserved, and tools like The Coroner's Toolkit (TCT [1]) and The Sleuth Kit (TSK [2]) could uncover the information necessary for restoring the file. Today, many filesystems delete the full set of meta information, leaving the data blocks. Putting these pieces together correctly is called file carving - forensic experts carve the raw data off the disk and reconstruct the files from it. The more fragmented the filesystem, the harder this task become.


----------

