How to Recover Data on an Ext4 File System
Table Of Contents
show
Whether you’re dealing with accidentally-deleted files, deleted or corrupted LUNs, or issues with an unresponsive NAS server or virtual machine setup, it can be a challenge to recover data on an Ext4 file system, even when there are plenty of data recovery tools at your disposal.
If you are not confident in recovering your data on your own, or if your attempts at doing so are unsuccessful, you should contact our data recovery specialists for help:
What is the Ext4 file system?
There are over 100 different types of file systems available for disk storage on the Linux operating system. The fourth extended file system, or Ext4 as its more commonly known, is one of the most popular choices and the default file system standard incorporated into all the major Linux distributions.
Recovering data from an Ext4 partition can be difficult. This is due to the way the operating system breaks up the data on an Ext4 file system using “blocks” and “block groups.”
A block is a group of sectors between 1KiB (1024 kb) and 64KiB (65536 kb) in size. Ext4 is efficient and structures data blocks into a series of block groups to boost performance. Block groups contain different types of blocks which aid the file system in structuring the data, including an Ext4 superblock, group descriptors, inode tables, inode bitmaps, and the actual data blocks.
How is the Ext4 file system designed to protect data?
Ext4 is a flexible, durable and backward-compatible file system (with Ext2 and Ext3) which supports a number of OS features and extended attributes aimed at providing scalability and reliability for large file systems.
Out of the box, Linux distributors advise that it is not possible to recover data from an Ext4 file system. However, alternative methods can potentially restore your data to its original source. Several tools exist that attempt to recover data by grepping the file system journal or undeleting lost inodes (to varying degrees of success).
However, in severe situations, off-the-shelf or free data recovery tools might not be able to help you when you need file recovery from an Ext4 file system.
These include:
Inode Tables
An inode table is a fundamental building block of the file system. It contains metadata about a file or block of data on an Ext4 file system. An application can retrieve the unique metadata by calling the known inode ID. Each inode represents a file from the file table. This file system approach improves performance and reduces fragmentation on the server.
Inodes contain pertinent information such as:
- File creation (birth) timestamp (btime)
- Last modification timestamp (mtime)
- Last status change timestamp (ctime)
- Size of file
- Device ID
- User ID (UID)
- Group ID (GID)
- And a pointer to the data
Inodes do not store the file name; that information lies in the file table. Each file name corresponds to only one single inode number. However, one file inode number may have many names that map to it. Querying Inode data is very simple on any Ext4 file system.
Journaling
Journaling is a feature of Ext4 designed to prevent data corruption. Essentially, a journaling log tracks write operations to the disk and ensures that any partially written jobs are completed next. The file system uses the journal if there is an unexpected reboot and data has not finished writing to disk to prevent corruption.
Journaling is a boon to data recovery tools and specialists. The log which tracks changes to the disk and to the file system metadata can be used to roll back destructive changes such as accidental or malicious deletion.
What Makes It Challenging to Recover Data from an Ext4 File System?
The above concepts are important to understand when looking into data recovery on an Ext4 partition. Data can be lost due to the following, regardless of the reliability of any associated hardware:
- Hardware issues
- Software issues
- User error
Data most frequently ends up deleted by user error or by malice. If your server does not have an up-to-date backup, then it may not always be possible to roll back and restore your critical data.
Here are just a few of the kinds of Ext4 data loss situations you might run into where your best option is to call upon Gillware’s professional data recovery services:
Ext4 Deleted or Inaccessible LUNs
When you use a network attached storage device, or NAS device, the underlying file system used by the device will often be Ext4 or another open-source Linux file system. NAS devices, especially those intended for use by many people in an organization, will often be partitioned into iSCSI targets identified by unique logical unit numbers, or LUNs.
A single LUN is, more or less, one giant file that acts as a container for other files. Because of its size, recovering data from a deleted LUN can prove particularly challenging. In most file systems (and Ext4 is no exception), the larger a file is, the less likely it is to be contiguous (i.e. all of its pieces located next to each other). Instead, these files are scattered in many tiny pieces all across the NAS device’s disks.
Ext4 can be highly destructive to deleted data. While it won’t erase deleted files automatically, it does immediately scrub the metadata regarding the file blocks’ locations. This makes all those individual pieces difficult to dig up and piece back together. When it comes to iSCSI targets, there are a lot of those pieces to collect.
Recovering deleted LUNs is work best left to professional data recovery experts with cutting-edge tools. Learn more about how we handle this situation by reading our Ext4 deleted LUN case study.
Deleted VMDK or Corrupted Virtual Machines
Ext4 and other Linux file systems commonly see use as platforms for hypervisors like VMWare Workstation or VirtualBox. Virtual hard disks and virtual machines function in much the same way as iSCSI targets and LUNs. They are all forms of “soft partitions,” files which act like hard disk partitions and contain data within them. When virtual machines become corrupted or are accidentally deleted, recovering data from them is often best left to data recovery specialists who understand the intricacies of virtual environments.
Hard Disk Failure
Whether your Ext4 device is a single hard disk drive in your PC or a NAS device used for external data storage, hardware failure is rarely something you can fix on your own. When a hard disk drive starts clicking or beeping, fails to spin up when you run power to it, or detects with the wrong capacity, there is almost always something wrong with it that can only be fixed in a professional data recovery lab with an ISO-5 standard clean environment.
These are the situations where you’ll want to have Gillware on your side. We’ve been salvaging data from broken hard disk drives, servers, and everything else with industry-leading success rates since 2003.
We have just scratched the surface when it comes to how we recover data on an Ext4 file system. Obviously, every recovery scenario is different. One must consider factors such as:
- The amount of data you are trying to restore
- Whether the data is encrypted
- Whether you have a hardware fault such as a failed RAID controller
- And other situations that complicate the data recovery process
If you’re struggling to recover data on an Ext4 file system and have any questions about how we can help, feel free to reach out to our data recovery advisors.
