In this e-age, we must have witnessed data loss every now and then. Though linux is not new to us, for its command mode and less user friendlier user interface, users are less comfortable at using it. Furthermore, if there happens any problem leading to data loss, the panic is beyond explanation. LINUX has some inbuilt commands for customizing the recovery of deleted files, still recovery from complex issues of data loss need more sophisticated utility like Linux partition recovery software.
Brief about ext3 file system:
Linux has many different file systems such as JFS, ReiserFS, XFS, ext2, ext3 etc. Here we are talking about ext3 file system and the recovery options once any file is deleted under this. ext3 or the third extended file system is an extended version of ext2 and is a journaled file system.
What happens when we delete a file in LINUX and recovery options:
When we delete any file, the block pointers corresponding to the file are marked unused in the block bitmap and marks the inode as "deleted", leaving the block pointers alone. In case of ext3 file systems, the block pointer is filled with ZERO and it seems impossible to recover. However, the information can be recovered from the journal file. That is, every time a file is accessed, the access time is changed and its inode is written to the disk along with some odd 31 other inodes in the same block. In this situation, a copy of that particular block is written into a journal and the block pointer carrying information about the deleted files can be recovered from that journal. Hence, by using any Linux data recovery utilities, we can recover deleted ext3 file, following recovering the information from the journal.
The most important thing to remember in case of Linux file recovery is that any write action should be avoided in the particular partition/volume, where a delete action has been performed. Furthermore, you should not install operations like 'fdisk', as it can overwrite the deleted data from the partition.
No comments:
Post a Comment