06.28.2010

Recovering Lost Files From the Ext3 File System in Linux The ext3 (third extended file system) is used by Linux kernel. It is a journaled file system, which is a default for many Linux distributions. Its major advantage over the ext2, its predecessor, is journaling that improves the reliability of the file system. It also minimizes the need to check the file system after an abrupt shutdown. Also, because of journaling there are no fragments in the file system. So, ext3 is a very efficient and smart. However, there is a chink in its armory.

The files that you delete are deleted permanently. This does not support recovery for files that have been deleted accidentally. But, you can recover the deleted files using appropriate method in ext3. However, if you are unable to recover the deleted files then you should use a third-party Linux data recovery tool for ext3 recovery.

Actually what happens is that the file, once deleted, remains in the file system. When you access a particular file, its access time is changed and its inode is written to the disk. At the same time, a copy of that block is written to the journal. Hence, there are chances that you may be able to recover the block pointers from the journal, which, in turn, will recover the deleted files.

However, you should make sure that you do not create a new file as it may overwrite the deleted file. In fact, most of the file systems do have some in-built utilities to recover the deleted files.

Likewise the ext3 has the ext3grep utility that enables you to recover the deleted files even if it is deleted using the "rm-rf" command. However, you should make sure that you dismount the hard drive as Linux is a multiuser and multitasking system and other processes or users can overwrite the disk space of the deleted file.

Although it is a safe tool that is able to recover the files without overwriting the disk it cannot recover the files that are larger than 2 GB. In such cases, you should use a third-party Linux recovery tool. Such tools are able to retrieve the deleted files from the ext3 file system.
Source:www.ezinearticles.com