Ext4 Data Recovery: What Works and What Doesn’t

Ext4 data recovery is possible in many cases, but the success rate depends heavily on how quickly you stop using the drive and which tools you use. This article explains how ext4 stores files, what happens when you delete one, and the practical steps you can take to recover data from an ext4 partition.

How Ext4 Stores Files

Ext4 is the default filesystem for most Linux distributions. It organizes data into blocks (typically 4 KB each) and uses structures called inodes to store metadata about each file—its size, permissions, timestamps, and the addresses of the blocks that hold the actual data. The inode table is a fixed-size area at the beginning of the partition, and a separate block bitmap tracks which blocks are free or in use.

When you write a new file, the kernel allocates an inode and the necessary data blocks, then updates the bitmaps and the journal. The journal is a circular log that records metadata changes before they are committed to the main filesystem, which helps prevent corruption after a crash.

What Happens When You Delete a File

When you delete a file on ext4, the filesystem does not erase the data blocks. Instead, it marks the inode as free and clears the corresponding entries in the block bitmap. The actual file content remains on the disk until those blocks are overwritten by new data. This is why recovery is possible—but it is a race against time.

One important nuance is that ext4 does not zero out the inode’s block pointers immediately. Some tools can still read those pointers to locate the file’s data. However, the filesystem may also use the freed inode for a new file very quickly, especially on a busy system. Additionally, the journal may contain remnants of the file’s metadata, which can sometimes be used to reconstruct the file.

Why You Must Stop Using the Drive Immediately

The single most important factor in successful ext4 recovery is to stop writing to the affected drive as soon as you realize data is missing. Every new file, log entry, or even a system update can overwrite the blocks that held your deleted data. If the drive is your main system drive, the safest approach is to power off the machine and boot from a live USB stick that loads the operating system into RAM, leaving the hard drive untouched.

If the data is on an external drive, unplug it immediately. If it is an internal secondary drive, unmount it and do not mount it again until you are ready to run recovery software. Mounting a filesystem can trigger journal replay and other metadata updates that may reduce recovery chances.

Recovery Tools That Work with Ext4

Several open-source tools can recover deleted files from ext4. Each works differently, and using more than one may improve your chances.

• extundelete – Uses the journal and inode information to restore deleted files. It works best when the files were deleted recently and the journal still has relevant entries. It can often restore files with their original names and directory paths.
• PhotoRec – Scans raw disk blocks for file signatures (headers/footers) of known file types (JPEG, PDF, ZIP, etc.). It does not rely on the filesystem metadata, so it can recover files even after the inode is reused, but it loses original filenames and directory structure.
• testdisk – Primarily for recovering lost partitions, but it can also repair the filesystem structure. If you accidentally deleted a partition or the partition table is corrupted, testdisk can often bring it back.
• debugfs – A built-in ext4 debugging tool that can sometimes recover files if you know the inode number. It is more advanced and requires manual intervention.

For a deleted file that was recently removed, extundelete is usually the best first choice. For a formatted partition or a heavily used drive, PhotoRec’s signature-based scan is more robust.

Step-by-Step Recovery Process

Here is a typical workflow for recovering files from an ext4 partition:

1. Stop using the drive. Unmount the partition or power off the system.
2. Boot from a live Linux USB (e.g., Ubuntu Live, SystemRescue) so the target drive is not mounted.
3. Identify the partition with lsblk or fdisk -l. Make a note of the device name (e.g., /dev/sdb1).
4. Install recovery tools on the live system (they are usually available in the default repositories).
5. Run extundelete on the unmounted partition: sudo extundelete /dev/sdb1 --restore-all. This creates a directory called RECOVERED_FILES with whatever it can restore.
6. If that fails, run PhotoRec on the partition: sudo photorec /dev/sdb1. Choose the partition, select the file types you want, and specify an output directory on a different drive.
7. Copy the recovered files to another storage device. Do not write them back to the same drive you are recovering from.

Common Problems and Misconceptions

One common misconception is that ext4’s journal guarantees recovery. The journal only contains metadata updates, not the file data itself, and it is overwritten in a circular fashion. If many operations have happened since the deletion, the journal entries may be gone.

Another issue is that ext4 may use the freed inode for a new file very quickly, especially if the filesystem is under load. Even if the data blocks are still intact, the inode pointers are lost, making it impossible for extundelete to locate the file. In that case, only a signature-based tool like PhotoRec can help.

Also, TRIM on solid-state drives is a serious problem. If your SSD supports TRIM and it is enabled, the drive’s firmware will immediately erase the blocks that were freed by the deletion. This makes recovery impossible, even with the best tools. If you are using an SSD, you should have backups—there is no reliable way to recover deleted files after TRIM has run.

When to Seek Professional Help

If the data is extremely valuable (e.g., business records, family photos, research data) and the above methods fail, you may need to consider a professional data recovery service. These services use specialized hardware and software, often in a cleanroom environment, to recover data from damaged or heavily overwritten drives. They can be expensive, and there is no guarantee of success, but they are the last resort for critical data.

Before sending your drive to a professional, make sure you have not written anything to it. Also, be aware that some services charge a diagnostic fee even if they cannot recover anything. Always ask about their success rate and pricing structure upfront.

Prevention: The Only Guarantee

The only way to guarantee you never lose data to deletion is to have a solid backup strategy. The 3-2-1 rule is a good starting point: keep at least three copies of your data, on two different types of storage, with one copy offsite. For Linux users, tools like rsync, rsnapshot, or cloud services can automate backups. A simple external hard drive with a scheduled rsync job is often enough for personal files.

If you are working with critical data, consider using a filesystem that supports snapshots, such as btrfs or ZFS. Snapshots allow you to revert to a previous state instantly, which can save you from accidental deletions or corruption. However, these filesystems have their own complexities and are not a substitute for regular backups.

Frequently Asked Questions

Can I recover files from an ext4 drive after formatting?

Yes, but only if the format was quick (not a full zero-fill) and you have not written much new data. Formatting recreates the filesystem structures, but the old data blocks remain. Tools like PhotoRec can scan the raw disk and recover files based on their content signatures, though filenames and folder structure will be lost.

How long after deletion can I still recover ext4 files?

There is no set time limit. It depends on how much new data has been written to the drive. On a lightly used drive, files might be recoverable for weeks. On an active system drive, the blocks could be overwritten within minutes. Stop using the drive immediately for the best chance.

Does ext4 have a recycle bin like Windows?

No, ext4 does not have a built-in recycle bin. When you delete a file with rm or a file manager, it is gone from the filesystem immediately. Some desktop environments (like GNOME or KDE) provide a trash folder, but that only works when you delete through the graphical interface, not from the command line.

Can I recover a file that was overwritten?

If the file’s data blocks have been partially or fully overwritten, recovery becomes much harder. PhotoRec may still find fragments of the file, but the result will likely be corrupted. There is no way to restore the original file perfectly once its blocks have been reused.

Is it safe to use the same drive to store recovered files?

No. Writing recovered files back to the same drive risks overwriting the very data you are trying to recover. Always save recovered files to a different physical drive, or at least a different partition that is not the one being recovered.

Related

• i7 14700K vs i7 13700KF: Which CPU Wins?
• Trickle Charger vs Battery Maintainer: Key Differences
• Mars Pathfinder: What Really Happened?