|
|
|
Ext4magic: Inode - Directory - Journal - Install - Time_Options - Histogram - Scenarios - Tips&Tricks - Manpage - Expert-Mode |
|
ext4magic |
|
|---|---|
|
|
|
|
Basic Data |
|
|
Developer: |
|
|
Actual Release: |
0.3.2 |
|
Release Date: |
2014-09-12 |
|
Operating System: |
Linux |
|
Dependencies: |
|
|
Category: |
|
|
License: |
GNU General Public License |
|
Documentation: |
English German |
|
Project Site: |
|
ext4magic is a disk utility to recover files from ext3 or ext4 partitions
It is based on ext3grep and extundelete, but was rewritten from scratch. In addition to the tools just mentioned ext4magic
handles more file types, also hardlinks and symlinks
extracts and using more information from the journal and the filesystem
restores owner, group and modification time (optional file attributes) of files and directories
can try to find moved and overwritten directories and files and more then one version of a file
can extract a lot of useful information about the journal and the journal data itself
has a file carving function at the end of a multi-step recover process with different recover methods
includes functions tries to recover a partially destroyed file system.
Contents |
Sooner or later it happens to everybody using a Linux system: You hit Enter and immediately realize you just started to delete important data on your system. Unfortunately you don't have any backup or you have a backup, but it's a very old and outdated. If you use ext2 as your filesystem you are able to recover the deleted data but ext3 and ext4 reinitializes block pointers to NULL (See Linux ext3 FAQ and ext4) and therfore a data recovery is not possible any more on ext3 and ext4. There exist scan tools (See HOWTO recover deleted files on an ext3 file system) which may be able to recover the data. Unfortunately nowadays most Linux distributions use ext3 or ext4.
ext3 and ext4 use a journaling file system to be
able to recover disk failures. This journal keeps copies of
internal file system information and file data and can also be used
to recover data deleted by accident. ext4magic is able to use the
information in the journal to recover most or even all of the lost
data, if such information are still available in the journal data.
There is no guarantee the data can be recovered because there are a
lot of factors which influence the recovery capabilities of
ext4magic and the tool may even fail to recover the important data.
But there is a given probability ext4magic is able to recover the
data.
The amount of changes done on the filesystem after some data was deleted by error impacts the recovery capabilities of ext4magic. Therefore it's important to stop working on the filesystem immediately or as soon as possible.
Some distribution provided community packets
The development of ext4magic create also some full feature packages by openSUSE Build Service
If you can not find a package for your
distribution, ext4magic can be compiled from source.
Follow the
instructions on the install page.
Release Note: currently available:
|
Attention: |
|
It's important to work on a unmounted or read only mounted partition or even better to create a copy of the partition in read only mode and use ext4magic on the partition copy. Otherwise important information in the journal can be overwritten and reduces the probability to successfully recover data. |
The most important invocation parameter to ext4magic is the target which should be recovered. It's either a block device (e.g. /dev/loop0) or a partition (e.g. /dev/sda1) or a file system image. There are no modifications done on the target but it's strongly recommended to create a copy of the target and run ext4magic on this copy. That way in case of any failure during the recovery it's possible to start over and create a new copy and start again the recovery procedure.
The copy should be created on any other partition on the same disk or another disk, or can also be a file on a other filesystem.
# dd if=/dev/DEVICE of=/BACKUPPATH/DEVICE.imgThe saved image of a partition can be used directly by ext4magic. If you created an image of a whole disk you have to use the loop device to get access to the partition (Details see below)
Be aware this will take some time depending on the disk size you copy. But double check the filesystem is mounted read only just before you start to create the copy!
You may also save the journal of the target only instead of the whole target. The journal is the repository of the needed information for the recover. A simple new mount, the next write, and also read or find commands on the read-write mounted file system will destroy some journal data. With a copy of the Journal immediately following the accident, later you have a good chance to recover files, if you can not use ext4magic immediately.
It's important to create this journal copy immediately before a new mount of the file system. Otherwise some journal data will be destroyed and lost. Create it also before the first using of ext4magic.
# debugfs -R "dump <8> /PATH/journal.copy" /dev/DEVICE
"/PATH/journal.copy" is the name of the file which will
get the journal and must be on a different filesystem.
"/dev/DEVICE" is the block device or partition
which should be recovered.
This snapshot of the current journal
now can be used by ext4magic for recovery analysis instead
of the existing journal on the target device.
# ext4magic /dev/DEVICE -j /PATH/journal.copy .......... Because the journal was now saved you can continue to work (should it really be necessary) on the filesystem but keep in mind filesystem blocks of deleted files may be overwritten now. Therefore it's strongly recommended to stop working on the filesystem immediately.
Images of partitions can be used directly by
extmagic.
Images created from a whole disk need a loop device in order to
access a partition. In most cases the partition to recover is not
the first one on the disk. An offset is required which points to
the start of the partition in the image.
Here
you can find a script that can this calculate, and the
instructions.
ext4magic {-M|-m} [-j <journal_file>] [-d <target_dir>] <filesystem>
ext4magic [-S|-J|-H|-V|-T] [-x] [-j <journal_file>]
[-B n|-I n|-f <file_name>|-i <input_list>]
[-t n|[[-a n][-b n]]]
[-d <target_dir>][-R|-r|-L|-l] [-Q] <filesystem>ext4magic has a huge number of options to control it's processing. There exist four different modes:
Magic mode -M or -m - a extensive and powerful multi-stage recover process, using different methods to each other
Recovery mode -R or -r - Recover deleted files and directories by inode copies
Analysis mode -S, -J, -H, -T- Analyze the existing filesystem and journal and provide information about the files, directories, inodes and data blocks
Disaster mode (optional) -D recover data from severely damaged file systems (Expert-Mode)
Filter options allow a fine grain control of the time
range, directory- and inodes and transactions used for recovery.
Input/output options are available to define the input sources used
for recovery processing and where the recovered files should be
written.
One option must always be specified, the file system.
This can be specified as a Partition or a virtual block device or
as a filesystem image.
These options allow to recover files in particular if files were deleted recursively or the whole file system was deleted at once. This starts a powerful multi-stage recover process and using different methods to each other.
|
Attention: |
|
Note: At the moment the full support for this function is for
ext3 only in version 0.2.x |
This function assumes:
The recent actions in the file system was the delete the files
Deleting the data has did not take longer than 5 minutes
Under these conditions, ext4magic finds itself the
optimal time parameters and the command line needs only the option
"-M" or "-m"
The function we
will work well even the delete process is running before many days.
ext4magic /dev/sda3 -M -d /home/recoverdir
But, was deleting not the last action in the file system, or
the deletion running very slow and has required a long time (> 5
minutes), or a long time there were many individual file deletions,
then additional is necessarily required the option -a with a
time stamp immediately before the beginning of the deletion. In
other cases, it will not work or only a few files will recover.
ext4magic /dev/sda3 -M -a 1330042429 -d /home/recoverdirYou can determine this timestamp with the histogram function ((see also, still needs to be translated))
This option controls the recovery algorithm used
and the way recoverable files are displayed. The processing works
recursive on directories and are influenced by time options. The
start directory for the search is either a directory name or an
inode number of a directory. Default is the root filesystem of the
filesystem to recover. Only files and directories can restored if a
undeleted inode copy is found in the file system journal. The
journal is designed for a different task, the fast restoring of the
consistency of the file system after a crash or similar problems,
and not for a recover of deleted files. So it's not ensured, that
always exists such a copy of each file is in the journal. Many
factors play a role which are of adequate data for a recover there.
(see journal, not yet been
translated)
That ext4magic can found
these copies, it needs a time window which determines the time
period of interest. ext4magic has a default time window, the last
24hours. This means, without specification of any other time window
only recovers files that have been deleted in the past 24 hours.
And that means: if files were deleted long time ago, it must be set
a different time window, otherwise these files can not found, even
if suitable inode copies available in the journal. Background
information and examples here
((currently only partially translate))
All recovered files will get their old filenames and if possible the old properties. -f defines the start directory to search or -I defines the start inode of the directory. If an inode number is defined the recovered directory will have the inode number as directory name. If a file will be recovered multiple times # chars are appended at the filename. A filename will have at most five #. Individual files can also recovered with time options and transaction numbers. If this function is used from the root directory the first stage of the multi-stage magic-function runs additional automatically. This will search for not found directories and files, because for that some required directory information missing. These files will be stored in the MAGIC-1 and MAGIC-2 directories.
Every recovery output starts with ;
--------
in front of each filename which marks the successful recovery. If access rights are missing to write the file there will show up some "x".
At the end of the recovery results from the hardlink database may be displayed. There are missing hardlinks detecetd if a positive number is written in front of the filename whereas too much hard links were found. if a negative number shows up, more filenames found for this recovered inode, as contained in the link counter of this inode. Cause may be varied. If the consistent state of the hard links are important for your files, you should evaluate the output of the hard link database.
It's impossible to detect whether datablocks were reused after deletion of a file and later on the reusing file deleted also. This can lead to files with defective data and every recovered file should be checked before it's used again.
These options generate status information of the filesystem and the journal.
100% means, no data blocks of the deleted file is currently in use. The same command line but with tho Option -r will recover all these files. This option can therefore easily used for check whether the time options are chosen correctly.
These options can be used to select the file, directory or the data block to process. These options cannot be combined in one command.
# ext4magic /dir/filesytem.iso -B 97 -t 22
# ext4magic /dir/filesystem.iso -B 97 -T
# extmagic /dev/sda3 -f usr1/Document
The following options define the time interval which is scanned in the journal and used to list or recover data. The interval start is defined by -a (AFTER) and the interval end by -b (BEFORE). In order to list or recover files, the files must have existed in a undeleted state between AFTER and BEFORE. AFTER prevents restore of very old deleted files, and all inode changes after BEFORE ignored. The Time should be in the form of the number of seconds since the UNIX epoch. All inode copies which are deleted before AFTER or change after BEFORE are ignored during processing.
If these options are not used the last 24 hours are recovered. If the data loss is detected more than one day later these options have to be used because otherwise nothing will be recovered. (Exception: Magic options -M and -m)
Example:
-a $(date -d "-3day" +%s) -b $(date -d "-2day" +%s)
see the Time Options Site for more details and examples.
The following options define the input and output.
Expert mode has to be enabled during the compile step with --enable-expert-mode during configure. That way corrupted filesystems can beopened to recover data. This allows to use the superblock backups to recreate a corrupted journal inode and to recover files on a partially or corrupted filesystem.
# ext4magic /dev/sda1 -s 4096 -n 32768 -c -D -d /tmp/recoverdir
more infos about these options near future
Expert-Mode
Some examples of using ext4magic. Typical scenarios with detailed description in near future on a separate page
# ext4magic /dev/sda3 -f /
# ext4magic /dev/sda3 -I 2
# ext4magic /tmp/filesystem.iso -f / -T -x
# ext4magic /tmp/filesystem.iso -j /tmp/journal.backup -I 8195 -t 182
# ext4magic /dev/sda3 -f user1/Documents -a $(date -d "-3 day" +%s) -b $(date -d "-2 day" +%s)
|
Attention: |
|
Don't use the journal of a filesystem mounted read/write because this can lead to incorrect recovery results. If for some reasons the filesystem has to be kept in read/write mode create a copy of the journal and use this copy with option -j during recovery. See Save journal copy paragraph above for details how to create a copy of the journal. |
# ext4magic /dev/sda3 -r -f user1/picture/cim01234.jpg -d /tmp
# ext4magic /dev/sda3 -r
# ext4magic /dev/sda3 -R -a $(date -d "-5day" +%s)
# ext4magic /dev/sda3 -M -d /home/recover
# ext4magic /home/filesystem.iso -Lx -f user1 | grep "jpg" > ./tmpfile
# ext4magic /home/filesystem.iso -i ./tmpfile -r -d /mnt/testrecover
|
Ext4magic: Inode - Directory - Journal - Install - Time_Options - Histogram - Scenarios - Tips&Tricks - Manpage - Expert-Mode |