[Feature]: Undelete files from ext4 filesystem

cgsecurity / testdisk

TestDisk & PhotoRec

https://www.cgsecurity.org/

GNU General Public License v2.0

1.69k stars 205 forks source link

[Feature]: Undelete files from ext4 filesystem #108

Closed DUOLabs333 closed 3 years ago

DUOLabs333 commented 3 years ago

Testdisk can currently undelete files from FAT, exFAT, NTFS and ext2 filesystems. Is it possible to extend this to ext3 or ext4?

cgsecurity commented 3 years ago

When a file is deleted from an ext3 and ext4 filesystem, the location of the first block is zeroed, so TestDisk can list all filenames, deleted or not, but it's not possible to undelete them. PhotoRec can be use to recover files with known filetypes from the free space of the filesystem and recover them but without the original filenames.