Recovering files from ext3 filesystem with foremost

So you accidentally removed some files on Linux ext3 partition and you want them back.
Here’s a procedure that worked for me:

1) Get foremost recovery tool. In Ubuntu it is in the universe repositories.
2) Unmount the partition where the files were. If it’s the root partition (say, /dev/sda1) , you cannot unmount it. In this case use Ubuntu Live CD or such to reboot into a system that does not mount the /dev/sda1.
3) Run (note that you must run with sudo):
sudo foremost -i /dev/sda3.

foremost will create a directory called output where all the recovered files are stored, separated in subdirectories according to filetype. If you need to recover only certain files, use the -t option:
sudo foremost -t jpeg,gif -i /dev/sda3
would only recover jpeg and gif files.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: