[Discuss] Ext4, ugh! Re: Disk recovery utilities - dealing with deleted files

[tmetro+blu at gmail.com (Tom Metro)]

Rich Braun wrote:
> There are a handful of well-documented utilities available for recovering ext3
> volumes, and pretty much nothing for ext4.  The ones that claim support for
> ext4 give no meaningful debugging output, and rely solely on contents of a
> journal that's apparently gone.

You tried 'foremost' or one of the other tools listed here?
https://help.ubuntu.com/community/DataRecovery#Extract_individual_files_from_recovered_image

These tools are designed to sift through unallocated space on a drive
and recognize common file structures (headers). They shouldn't care
about the presence of a journal file.

That the tools you are trying do, makes me wonder if you are chasing
after the wrong type of solution. I would expect journal files to only
be useful if the data on your disk is inconsistent with what is in your
directory structures.

In this case, you accidentally performed a delete operation, which fully
completed and was synced to disk. The disk itself should be self-consistent.

Are the tools you are trying claim to use the journal to find where
recently deleted files were stored? I could see that being a useful
shortcut, but they'll eventually get flushed from the journal and then
you'll need a different strategy. Perhaps they figure your deleted files
will be overwritten by then.

 -Tom

-- 
Tom Metro
Venture Logic, Newton, MA, USA
"Enterprise solutions through open source."
Professional Profile: http://tmetro.venturelogic.com/