24

08/09

Data recovered

09:40 by skaven. Filed under: Uncategorized

I managed to recover the accidently deleted data. Due to the fact, that I recognized my mistake while the deletion process I unmounted the partition directly afterwards and made an image of it with dd.
After some searching on the internet I’ve found ext3grep. With one simple command everything was restored, since I knew the date of deletion.

ext3grep $IMAGE --restore-all --after=1250740800

This command restored all recoverable files from $IMAGE (which represents the path of my dd-Image) after Thu, 20 Aug 2009 04:00:00 GMT (referenced by the UNIX timestamp 1250740800).
Since I had unmounted the partition ther were no write actions after the deletion, so each deleted file was recoverable.

RSS feed for comments on this post.


Sorry, the comment form is closed at this time.