Sunday, 4 January 2015

EXT3 undelete

As you probably know, there are three basic variants of EXT filesystem versus undelete, depending on whether extents and journaling are used.
  • no extents and no journaling - EXT2; 
  • journaling only, but no extents - EXT3;
  • both journaling and extents - EXT4. 
Journaling for whatever fancy filesystem development reasons requires inodes to be cleared (overwritten with zeros) when files are deleted.

However, we now have an undelete capability for EXT3 (where extents are not used) in our ReclaiMe Pro software. The undelete requires the full scan of the disk to work, and also file names cannot be recovered (because inodes are gone), but otherwise works fairly decent.

No comments:

Post a Comment