Return to Filesystems

The ext2 (Second Extended File System) was one of the most popular file systems for Linux systems before being replaced by ext3 and ext4. Although ext2 does not have journaling features like its successors, it is still used in specific applications where simplicity and reduced write operations are essential, such as embedded systems or SD cards. Recovering deleted files from ext2 is easier than journaled systems since the file system doesn't immediately overwrite deleted file data.

Below is a detailed look into file recovery techniques and tools relevant to the ext2 file system.

• **Metadata Structure in ext2**

   The [[ext2]] file system stores file data and metadata separately. Each file has an inode that contains essential metadata (file size, permissions, timestamps) and pointers to the data blocks. When a file is deleted, only the inode and directory entries are marked as unused, but the data remains intact until it is overwritten.

 *Relevant links:*  
 https://www.kernel.org/doc/html/latest/filesystems/ext2.html  
 https://ext4.wiki.kernel.org/index.php/Ext2_Howto

• **Using `e2fsprogs` to Recover Files**

   The `e2fsprogs` suite includes tools such as `e2fsck` and `debugfs`, which can inspect and repair [[ext2]] partitions. `debugfs` allows users to access inodes directly, providing a way to restore deleted files if their blocks haven't been overwritten.

 **Example Usage:**
 ```bash
 debugfs /dev/sdX1
 lsdel  # List deleted files
 ```
 After identifying the inode, the file can be recovered using the `dump` command within `debugfs`.

 *Relevant links:*  
 https://github.com/tytso/e2fsprogs  
 https://linux.die.net/man/8/debugfs

• **`extundelete` Tool**

   `extundelete` is a tool specifically designed for recovering files from [[ext2]], [[ext3]], and [[ext4]] file systems. It scans inodes and block groups to restore deleted files.

 **Example Usage:**
 ```bash
 extundelete --restore-file  /dev/sdX1
 ```
 This command attempts to recover a specific deleted file from the given partition.

 *Relevant links:*  
 https://sourceforge.net/projects/extundelete/  
 https://github.com/extundelete/extundelete

• **Preventing Overwrites by Mounting Partitions Read-Only**

   When a file is accidentally deleted, it is essential to immediately unmount the partition or remount it in read-only mode to prevent data from being overwritten.

 **Example Command:**
 ```bash
 mount -o remount,ro /dev/sdX1
 ```

• **Backup Solutions Using File Dump Tools**

   Regular backups can prevent data loss. Tools like `dump` allow users to create backups of entire [[ext2]] file systems, which can later be restored using `restore`.

 **Example Backup Command:**
 ```bash
 dump -0u -f backup.dump /dev/sdX1
 ```

 *Relevant links:*  
 https://linux.die.net/man/8/dump  
 https://linux.die.net/man/8/restore

Although ext2 lacks journaling, its simplicity makes data recovery straightforward as long as the affected sectors are not overwritten. Tools like `debugfs` and `extundelete` offer powerful recovery options, while preventive steps, such as mounting partitions in read-only mode, can further enhance the chances of successful recovery. For critical systems, implementing regular backups remains the most reliable way to protect against data loss.