e2retrieve

e2retrieve is a data recovery tool for Ext2 filesystem. This means that e2retrieve will not try to repair the filesystem but will extract data to "copy" it to another place (another disk, NFS, Samba, ...).

e2retrieve:

• can recover data from a truncated or split ext2 filesystem (in the case of a LVM with a disk that has crashed, for example),
• will not write onto the ext2 filesystem it is analysing, therefore it will never increase damages previously caused,
• recovers directories, directories tree, files, symbolic links and special files with their access rights, owner and modification date,
• is fully written in C from scratch,
• does not need any library,
• can easily fit in a rescue floppy disk (in the case where you do not have enough IDE slots),
• is not an undeleting tool

I started e2retrieve because I got a crash disk, and that disk was part of a LVM (and that disk represented the first 10GB of the LVM...). I thought that remaining data on the other disks could be recoverable, so e2retrieve started as a challenge (for me) and a way to better understand the underneath of Ext2.
The other reason I started e2retrieve is that I wasn't able to find such a tool (now, it seems that e2extract does something similar), and e2salvage didn't do what I expected.

e2retrieve shouldn't be useful for those who are working in enterprise because they do backups (or they should do), but when when you are at home you can't pay for a full backup of 120GB, for example; but this doesn't meen you have to loose all of your data...

Download

This version must considered alpha because even if it worked for me, I tweaked some internal algorithms for my needs, so some of these things can still be present. Plus, I'm not very confident with the scanning process. If you play a bit with e2retrieve and that you see something weird, I encourage you to send me a mail. You can even send me raw data or image file you played with by FTP (through my ADSL line...). e2retrieve_20031216.tar.gz

NEW: this is a new version of e2retrieve_rescuedisk that should compile better (tested on Slackware 9.0, Suse 8.2 and Redhat 6.2 with GCC version 2.96, 3.2 & 3.3).

The following archive (e2retrieve_rescuedisk.tar.gz 36MB) will help you in creating a floppy bootable disk to recover your files. The bootable floppy disk will contain (after compiling and/or tweaking):

• Linux kernel 2.4.21 patched with Device Mapper for LVM2 support (framebuffer, ext2, ext3, reiserfs, no SCSI, device driver for common network card)
• uClib and Busybox,
• LVM2 utilities (and library) with support for LVM1 format,
• mke2fs, fdisk,
• french keyboard layout
• and e2retrieve :)

The archive is very big because it contains all sources. It comes with a Makefile that will assist you in compiling. The archive do not contain e2retrieve, so you must download it and put it in the good directory (see README file). All is x86 oriented, but you can adapt it easily to be build for another architecture.

Links

Through the following links, you may find something that better fits your needs, gives better results or help going :

• e2salvage
• e2extract
• e2undel
• Easy Recovery : data recovering tool for Microsoft Windows filesystems (commercial).
• gpart : primary partition table "guesser" tool (no homepage for this tool so I send you to Google).
• foremost : recover files based on their headers and footers (work on raw data files from dd for example).
• fatback : FAT recovering tool (available from the Biatchux bootable CD project for forensic/analysis/data recovery/virus scanning/...
• TestDisk : check and undelete partition (a lot of partition types are recognized).
• Active@ Partition Recovery : MBR and partition recovery tool (commercial).
• myrescue : a sort of 'dd' like tool, but specialized in harddisk data copy (better handle of damaged areas).
• recoverdm : again, a 'dd' like tool. Seems that it had a special mode for CDROM.

• Data Recovery : a lot of links related to data recovery at dmoz directory.