How do I recover missing files on an ext3 hard drive?

Posted on 2004-10-21
Last Modified: 2013-12-15
We have a Linux computer that lost power, without being powered down properly. Its now missing a critical directory, containing about 1000 critical files.

How would I recover that data?
Question by:Risky101
    LVL 6

    Expert Comment

    When you brought the system back up was not a fsck run on it?  What was the result?

    More newer distros use some kind of journaling file system, such as ext3.   Give us a bit more information and perhaps we can help you out.

    Author Comment

    Its an ext3 file system, running on Fedora 2. Another system we have is running on Redhat 9.1 - we've had the same symptoms on it too.

    Running fsck.ext3 on it made no difference.

    Author Comment

    Is there some way we could use an alternate superblock? Would that possibly fix the problem?

    Author Comment

    As more clues, the directory contains about 1,000 .png files. The directory is called "data". We need to recover this directory, and the .png files contained in it.
    LVL 17

    Expert Comment

    Have you tried any of the undelete tools? They were developed for ext2 but ext3 is just ext2 with journalling support. Have a look at

    Author Comment

    Sorry, this wont work. From

    "The following applies only to ext2. Even ext3, despite its compatibility with ext2, behaves in one crucial point differently from ext2 (see below), so undeleting files on ext3 requires a completely different approach."

    In addition, the e2undel page does not mention ext3 compatibility.

    Accepted Solution

    *** BAD NEWS! ***

    Q: How can I recover (undelete) deleted files from my ext3 partition?
    Actually, you can't! This is what one of the developers, Andreas Dilger, said about it:
    In order to ensure that ext3 can safely resume an unlink after a crash, it actually zeros out the block pointers in the inode, whereas
    ext2 just marks these blocks as unused in the block bitmaps and marks the inode as "deleted" and leaves the block pointers alone.

    Your only hope is to "grep" for parts of your files that have been deleted and hope for the best.

    A:  sounds like mirroring or backups is the only saving grace!

    Author Comment

    Thanks for this. We have implemented a backup policy.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone. Privacy Policy Terms of Use

    Featured Post

     Java Android Coding Bundle

    Whether you're an Apple user or Android addict, learning to code for the Android platform is an extremely valuable, in-demand skill. It all starts with Java, the language behind the apps and games that make Android the top platform it is today.

    In this tutorial I will explain how to make squid prevent malwares in five easy steps: Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response times by caching and reusing frequently-…
    This is the error message I got (CODE) Error caused by incompatible libmp3lame 3.98-2 with ffmpeg I've googled this error message and found out sometimes it attaches this note "can be treated with downgrade libmp3lame to version 3.97 or 3.98" …
    Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
    Connecting to an Amazon Linux EC2 Instance from Windows Using PuTTY.

    875 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    8 Experts available now in Live!

    Get 1:1 Help Now