Recovering Deleted Files From An ext2/ext3 Filesystem

Well, for starters you can treat ext3 as ext2. This means we can use e2fsprogs.

You should unmount the filesystem. Do not make any more changes. You might need to reboot with a rescue disk in order to work on the filesystem. In my case, I didn't. The system ran fine without the filesystem mounted and I already had the necessary tools installed.

Next, run debugfs <device>, where <device> is the partition containing the filesystem you want to restore from (eg, /dev/hda3).

Once you're in debugfs you can list the deleted inodes using lsdel.

Look at the owners and the deletion times of the inodes to determine which inodes you're interested in.

Once you've determined the inodes you need to restore, dump -p <inode> <output file> for each one.

When you've finished restoring, you can mount the filesystem again and restore the files to their original location.

There is another way to do this using debugfs that results in the files appearing in lost+found when you mount the filesystem again. However, it involves modifying inodes.