Deleted files recovery for Linux
Major file systems used by Linux include Ext2, Ext3 and Ext4, XFS, ReiserFS, JFS (JFS2) etc. These systems are interchangeable within the majority of Linux operating systems.
Ext2, Ext3, Ext4
This is “native” file system of the Linux operating system under active developments and improvements. The Ext3 file system is just an extension to Ext2 with transactional file writing operations and the so-called journaling. Ext4 is the further development of Ext3, extended with optimized file allocation information support (extents) and support of “extended file attributes”. This file system is very often used as “root” file system for most Linux installations.
During the deletion on Ext2, information about the file is partially wiped and the time of deletion is noted. Recovery of the file content is possible without the file name, however. The file name to the node reference is wiped. Deleted files can be recovered with any of UFS Explorer Software or Raise Data Recovery.
During the deletion on Ext3/Ext4, the system wipes the information about the file location as well. As this operation is performed via the journal, file recovery – even with file name – is possible immediately after the deletion. File recovery is possible either with Raise Data Recovery or any of the UFS Explorer software.
XFS is an old journalizing file system created by Silicon Graphics (SGI) originally for use with their IRIX-based servers, workstations and visualization systems. XFS is also available for most Linux distributions to create large data storage volumes. The XFS file system is known to give good performance when storing and accessing large files. Thus, it is applied in huge storage systems as well as re-used in network storages, such as Buffalo, Adaptec, Iomega, LaCie, Synology etc.
XFS provides quite good support of the recovery of deleted files: files can be recovered, though file size might be incorrect (larger). When a file is deleted from XFS, the system clears the information part of a file node and updates a tree of free blocks. Thus, the information about the file name is not linked with the directory entry. Data created in XFS can be recovered with Raise Data Recovery for XFS.
This is an alternative Linux file system with the main purpose of storing huge number of small files. It has a good capability of search and allows “compacting” of the file allocations by storing file tails or small files along with metadata without taking large file system blocks for this. When a file is deleted from ReiserFS, the system updates its S+-tree to exclude a file and updates the map of free space. Due to considerable duplication (including journal) of the information, ReiserFS has strong chances for the recovery of deleted files keeping their exact size, locations and names. Raise Data Recovery, as well as Recovery Explorer and UFS Explorer are perfect for this case of data loss.
This file system was developed by IBM specifically for their powerful computing systems. Saying JFS one usually means JFS, second edition (JFS2). Currently this file system is open-source and is implemented in modern Linux distributions. JFS has good chances for recovery of the file contents. However, names of files might be recovered incorrectly. When a file is deleted from JFS (JFS2), the system updates the object use counter and releases an inode in the inode use map. The directory is rebuilt to reflect changes. Data recovery is possible with Raise Data Recovery or any other Recovery Explorer and UFS Explorer software products.
Note: Like any recovery of deleted data, file recovery from these file systems is possible until the space of the disk is re-used for a new file.