Taking a practical case in which you are working on a Linux system that has ext2 file system. Suddenly, there is a power outage and the system shuts down abruptly. When the power is restored, you switch on the system, only to find that you have lost some of the files.
Cause:
There could be the following reasons for such situation:
The system could be virus infected that could have caused the data loss.
There could be some bugs in the operating system version.
It could be possible that the logical drives may be accidentally deleted.
The partition table may have got corrupt or damaged.
Resolution:
There are few in-build tools that you can use to recover the lost files. But first of all, you should ensure that you unmount the file system from which the files have been lost. To recover the lost files, you can perform the following tools:
debugfs: This tool is very useful in bringing back the deleted files if it is already installed on your system. To do the recovery, you need to perform the following files:
Try the following command to invoke 'debugfs'
/sbin/debugfs device
where, 'device' is the file system
In the 'debugfs' prompt, enter the following command:
lsdel
The deleted files will be enlisted. From here, you can see the deleted files.
To write the data of the deleted file in a new file, enter the following command:
dump filename
Where, 'filename' is the name of the deleted file
Now, repeat this command to recover all the rest deleted files.
When done, type 'q' to exit 'debugfs' prompt.
E2undel: This tool is also used to recover deleted files, but it has better interface and provides more options while recovering the files. To recover the files, you have to provide the following command:
e2undel -d device -s path [-a] [-t]
Well, if even these tools are unable to recover the lost data then there is an urgent requirement to use a third-party ext2 recovery software to restore deleted files. With use of advanced scanning algorithms, these tools ensure that Linux recovery is safe and secure.
By Kuldeep Kulmii
