Recovering files from ext3 filesystem with foremost

So you accidentally removed some files on Linux ext3 partition and you want them back.
Here’s a procedure that worked for me:

1) Get foremost recovery tool. In Ubuntu it is in the universe repositories.
2) Unmount the partition where the files were. If it’s the root partition (say, /dev/sda1) , you cannot unmount it. In this case use Ubuntu Live CD or such to reboot into a system that does not mount the /dev/sda1.
3) Run (note that you must run with sudo):
sudo foremost -i /dev/sda3.

foremost will create a directory called output where all the recovered files are stored, separated in subdirectories according to filetype. If you need to recover only certain files, use the -t option:
sudo foremost -t jpeg,gif -i /dev/sda3
would only recover jpeg and gif files.

Advertisements
%d bloggers like this: