subject: LINUX data recovery from ext3 file system partition is possible [print this page] What happens when we delete a file in LINUX and recovery options:
When we delete any file, the block pointers corresponding to the file are marked unused in the block bitmap and marks the inode as "deleted", leaving the block pointers alone. In case of ext3 file systems, the block pointer is filled with ZERO and it seems impossible to recover. However, the information can be recovered from the journal file. That is, every time a file is accessed, the access time is changed and its inode is written to the disk along with some odd 31 other inodes in the same block. In this situation, a copy of that particular block is written into a journal and the block pointer carrying information about the deleted files can be recovered from that journal. Hence, by using any LINUX recovery software, we can recover the deleted file, following recovering the information from the journal.
The most important thing to remember in case of LINUX data recovery is that any write action should be avoided in the particular partition/volume, where a delete action has been performed. Furthermore, you should not install operations like 'fdisk', as it can overwrite the deleted data from the partition.
These LINUX data recovery utilities are very scientific and are designed keeping the storage pattern of the file system in mind. Moreover, these LINUX data recovery software are very flexible in their operation, which leave no ground for procrastination and hence, quite usable for professionals as well as common non-technical users.
LINUX data recovery from ext3 file system partition is possible
