ThisCalculator

Everyday

Recover Files ext3 ext4 Linux: Complete Guide

Updated · Standard formula, shown below

Recover Files ext3 ext4 Linux: Complete Guide

Yes, you can recover deleted files from ext3 and ext4 filesystems on Linux, but success depends on acting quickly and using the right tool. This guide explains the recovery options, how they work, and step-by-step methods to get your data back.

Why Ext3 and Ext4 Deletion Is Tricky

When you delete a file on ext3 or ext4, the filesystem does not immediately erase the data blocks. Instead, it marks the inode (the metadata entry) as free and removes the directory entry. The actual file content remains on the disk until the blocks are overwritten by new data. This is why recovery is possible—but also why you should stop using the drive immediately after deletion.

Ext4 adds a few features that affect recovery:

  • Extent trees replace the indirect block mapping of ext3, making file layout more efficient but also changing how recovery tools scan.
  • Delayed allocation (ext4) writes data to disk later than ext3, which can complicate recovery if the system crashes before the data is flushed.
  • Inode initialization in ext4 zeroes some fields, so tools that rely on inode metadata may find less information.

Despite these differences, most recovery tools support both filesystems, and the basic principle remains the same: recover before overwriting.

What You Need Before Starting

Before running any recovery tool, you must prepare:

  • A separate storage device with enough free space to hold the recovered files. Do not write recovered data back to the same disk.
  • Root privileges (sudo) because raw device access is required.
  • Unmount the partition if possible. If the partition is your root filesystem, boot from a live USB to unmount it safely.
  • Backup of the disk image (optional but recommended) before attempting recovery, so you can try multiple tools without risking further damage.

If you cannot unmount the partition, at least remount it read-only with mount -o remount,ro /dev/sdXY. This prevents new writes that could overwrite deleted data.

Recovery Tools Overview

Several open-source tools can recover files from ext3/ext4. Each uses a different approach:

  • extundelete – Uses the journal to replay deleted inodes. Best for recent deletions on ext3, but works on ext4 if the journal is intact.
  • PhotoRec – Scans raw disk blocks for file signatures (carving). Works on any filesystem, but loses filenames and directory structure.
  • TestDisk – Can recover lost partitions and repair boot sectors, but not individual files by name.
  • debugfs – A built-in ext2/ext3/ext4 filesystem debugger that can sometimes recover files if the inode is still present.
  • ext4magic – Uses the journal and can recover files that were deleted after the journal was last checkpointed.

Step-by-Step Recovery with extundelete

extundelete is often the first choice because it attempts to restore original filenames and paths. Here is how to use it:

  1. Install extundelete: sudo apt install extundelete (Debian/Ubuntu) or sudo dnf install extundelete (Fedora).
  2. Unmount the partition: sudo umount /dev/sdXY (replace sdXY with your partition).
  3. Run a dry run to see what can be recovered: sudo extundelete /dev/sdXY --restore-all --output-dir /recovery (without –restore-all, it lists recoverable files).
  4. If the dry run looks good, perform the actual restore: sudo extundelete /dev/sdXY --restore-all --output-dir /recovery.
  5. Check the /recovery directory for a folder named RECOVERED_FILES.

If extundelete fails, it may be because the journal has rotated or the inode was reused. In that case, try PhotoRec.

Recovering with PhotoRec (File Carving)

PhotoRec ignores the filesystem structure and scans raw disk blocks for file signatures. It is more likely to find files that extundelete cannot, but you lose filenames and folder structure. The recovered files are named after their type (e.g., f1234567.jpg).

  1. Install testdisk (which includes PhotoRec): sudo apt install testdisk.
  2. Run PhotoRec: sudo photorec /dev/sdXY.
  3. Select the partition and choose the filesystem type (ext2/ext3).
  4. Choose whether to recover only unallocated space (faster) or the whole partition.
  5. Select a destination directory on a different drive.
  6. Wait for the scan to complete. The time depends on disk size and speed.

PhotoRec is particularly useful when the filesystem is severely damaged or when the journal is gone.

Common Problems and How to Avoid Them

Recovery often fails for predictable reasons. Knowing these can save you time:

  • Continuing to use the disk – Every new file write can overwrite deleted data. Stop using the drive immediately.
  • Running recovery on the same disk – The recovery tool itself may write to the disk if you output to the same partition. Always output to a different drive.
  • Journal overwritten – extundelete relies on the journal. If the journal has been rotated, recovery becomes harder. Check with dumpe2fs -h /dev/sdXY for the journal size.
  • TRIM on SSDs – If your drive is an SSD and TRIM is enabled, deleted blocks may be zeroed immediately, making recovery impossible. This is a hardware-level feature.
  • File fragmentation – Ext4 extents reduce fragmentation, but large files can still be non-contiguous, making carving less effective.

When to Use a Disk Image Instead

If you have time, create a full disk image before attempting recovery. This is the safest approach because it lets you try multiple tools without risking the original data. Use dd or ddrescue to copy the partition to an image file on another drive:

sudo dd if=/dev/sdXY of=/recovery/partition.img bs=64K

Then run recovery tools on the image file instead of the raw device. Many tools accept an image file as input, e.g., extundelete partition.img --restore-all. This is especially useful if the disk has bad sectors; ddrescue handles those gracefully.

Frequently Asked Questions

Can I recover files from ext4 after a fresh install?

If you reinstalled the OS, the new filesystem may have overwritten the old data. Recovery is still possible in some cases if the new installation did not use the entire disk, but the chances drop significantly. Tools like PhotoRec can still find file remnants, but filenames are lost.

Is there a GUI tool for ext4 recovery?

Yes, some frontends exist, such as R-Linux (free for ext2/ext3/ext4) and DiskGenius. These are not open-source but provide a graphical interface. For command-line users, the tools mentioned above are sufficient.

How long does recovery take?

It depends on disk size and speed. A 1 TB drive can take several hours with PhotoRec, while extundelete may finish in minutes if the journal is intact. The number of files and fragmentation also affect time.

Can I recover files from a corrupted ext4 partition?

Yes, but the approach differs. If the partition is corrupted, first try fsck to repair the filesystem, then attempt recovery. If fsck fails, use PhotoRec to carve files directly from the raw device.

What is the difference between ext3 and ext4 recovery?

Ext3 uses indirect block mapping, which makes it easier for tools to reconstruct file data. Ext4 uses extents and has delayed allocation, so recovery tools must handle these differences. In practice, extundelete works on both, but ext4 recovery may be less successful if the journal is not available.

Will recovery work on an SSD with TRIM enabled?

No, if TRIM is active, the SSD firmware zeroes deleted blocks, making recovery impossible. Some SSDs allow disabling TRIM, but this must be done before deletion. For HDDs, TRIM is not an issue.

Related

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.