24
08/09
Data recovered
I managed to recover the accidently deleted data. Due to the fact, that I recognized my mistake while the deletion process I unmounted the partition directly afterwards and made an image of it with dd.
After some searching on the internet I’ve found ext3grep. With one simple command everything was restored, since I knew the date of deletion.
ext3grep $IMAGE --restore-all --after=1250740800
This command restored all recoverable files from $IMAGE (which represents the path of my dd-Image) after Thu, 20 Aug 2009 04:00:00 GMT (referenced by the UNIX timestamp 1250740800).
Since I had unmounted the partition ther were no write actions after the deletion, so each deleted file was recoverable.
Comments Off