Read this article to learn more about top tools to recover data lost from partitions on a disk with Ext4/3/2 file system used by Linux. We will explore thoroughly what each data recovery tool can do.

Introduction

By default, most modern Linux distributives use the Ext4 file system, in the same way as older distributives typically used Ext3 or Ext2 file systems, and the whole thing started one day in the past with them using the original Ext system.

One of the features within Ext2 is that the file system removes partially the information about deleted files, in particular, links to file names, which makes recovering such file names an almost impossible task. Journaled file systems Ext3 and Ext4 perform the deleting operations via the journal. The probability of recovering data from such systems depends largely on the size of the journal and on how long the operating system worked after a certain file was deleted. That is why it’s important to take immediate action right after you discover important information was lost. In our case, immediate action means you should stop writing data to the disk from where the important information was removed, and find a reliable app to help you bring the files back.

We have selected some of the most popular data recovery solutions which you may wish to use, and conducted a few tests. Below, we will present the test results for each tool.

Read this article to find out which of them can do better when it comes to recovering lost information from the hard disk.

Hetman Partition Recovery;
R-Studio;
EaseUs Data Recovery Wizard;
Disk Drill;

File system structure and the algorithm used to find the lost data

Before we start testing various tools, let’s explore the structure of these file systems.

This file system contains a bootloader which consists of a series of block groups.

The structure of each group begins with a Superblock followed by Group Descriptors, then followed by Block Bitmap, then by Inode bitmap, then by Inode table, and the final element is Data, that is, the information stored in a volume.

Ext4 has evolved from Ext3, the most popular file system for Linux. In many aspects, Ext4 means more progress from Ext3, than Ext3 did in comparison with Ext2. The most significant improvement in Ext3 versus Ext2 was the introduction of “journaling,” while Ext4 brings more changes to important system structures, such as those meant to store file data.

It allowed to create a more advanced file system, with a performance boost, a wider range of functions and at the same time, with more stability.

At the moment, the maximal Ext3 file system size is 16 terabytes, and file size is limited to 2 terabytes. Ext4 adds 48-bit block addressing which means that the maximal file system size is now 1 exabyte, and it can hold files as large as 16 terabytes each. 1 EB (exabyte) = 1,048,576 TB (terabyte), 1 EB = 1024 PB (petabyte), 1 PB = 1024 TB, 1 TB = 1024 GB. Why 48-bit, and not 64-bit, you may ask? There was a number of restrictions that had to be removed in order to make Ext4 a completely 64-bit file system, but Ext4 was not designed with 64-bit structure in mind, though. Data structures in Ext4 were created with consideration of the required changes.

Currently, a single directory in Ext3 cannot contain more than 32,000 subdirectories. Ext4 gets rid of that restriction and lets you create an unlimited number of subdirectories.

The latest file system, Ext4, has the design of a B-tree. That is why the data is stored in the tree’s leaves, and in order to access the information, a data recovery tool has to go down the chain of links before restoring any files.

If some elements of this chain are removed, there are chances that the data recovery tool won’t be able to find the path to your data. In today’s tests, we will try deleting some elements of the file system structure and find out how best data recovery tools can cope with the problem.

Tests and benchmarks for data recovery tools
In Windows, you need a specialized utility or a special driver to view the contents of a disk formatted into EXT4/3/2. Fortunately, data recovery tools can help you view the contents of such devices and restore data from them.

For our benchmarking assessment, we have selected several popular data recovery tools such as Hetman Partition Recovery, R-Studio, EaseUs Data Recovery Wizard, Recuva and DiskDrill. After a preliminary round of testing we had to exclude one of the participants – Recuva – because it could find only a small portion of files on an Ext 4 drive. Being able to recover only 20% of the lost data, it is evidently the tool least suitable for the job, so we decided to remove it from the list. Even when we gave it another chance and ran the test for the second time, it wasn’t able to find virtually anything.

All right, let’s get down to testing.

On a computer running a Linux operating system, we’ve created a test disk with Ext4 file system. We copied some data to the disk – pictures, videos, and documents. After that, a part of the data was removed, and the disk was unmounted.

All further tests in data recovery were conducted on a Windows 10 computer.

Testing Hetman Partition Recovery

After connecting the test disk with Ext4 file system, Windows 10 can’t recognize this file system, and when the disk is connected, the operating system suggests formatting it.

However, in fact there is no need to format anything – start the first utility on the list, Hetman Partition Recovery and scan the disk.

The program can recognize the disk, detect its file system and display its name and size properly.

For starters, we only run Fast scan, and it appears to be enough to gain good results.

Here’s the result: 2 folders and 20 files are found.

Evidently, this tool has no difficulty in finding the files deleted in such a way. We didn’t have to use Full analysis, and it saved us a lot of time.

Removed data is marked with a red cross. All the files can be previewed and recovered without effort. The disk structure is retained, so all files and folders can be located in a second: it makes searching for specific data extremely easy.

The program has completed this test successfully and met the challenge just as we expected. All deleted files could be recovered.

Testing R-Studio

R-Studio can also recognize the test disk, detect its file system and display its name and size properly.

The program has found all the files, and their contents can be previewed.

However, it doesn’t apply to documents.

The disk structure and file names are retained. However, after a quick scan it can’t display contents of the documents.

In the end, even a deeper scan hasn’t changed anything.

This tool has passed the test too, but it has some difficulties in displaying documents. All deleted files have been recovered.

Testing EaseUs Data Recovery Wizard

EaseUs Data Recovery Wizard can display the drive, recognize its name and size. However, the file system type is not displayed.

When we try to analyze the disk the program switches to Advanced Scan at once.

It has found all the files, but the disk structure is lost as well as file names, and all the files are sorted by file type into separate folders. The program seems to be checking the disk with in-depth analysis, so it’s going to take a long time if you’re working with high-capacity drives.

In the end, the program has found all the files and sorted them by file type into folders. All documents are located, and they can be previewed.

As to video files, one of them is damaged.

All the photos are present.

Unfortunately, deleted files have no markings to distinguish them from the files which are still on the disk. The only way to tell if all files are present is by counting them. As you can guess, finding the file you need is going to be quite a challenge when there are many of them on the disk, and it will take a long time to view every file. The program has completed this test successfully, and only one video file couldn’t be recovered.

Testing Disk Drill

Disk Drill recognizes the test disk, displays its name and size.

When choosing the scan type, Quick Scan is not available, so we had to run the Deep Scan.

Deep Scan results:

The program has found the data, but couldn’t restore the disk structure or the file names, and sorted the files into folders by file type.

All the photos are present, and their contents can be previewed.

One video file is damaged.

The program has found all the documents, and their contents can be previewed.

It has coped with the task successfully, although it took quite a long time to complete the scan; this may become a serious issue when you work with a high-capacity drive containing a number of files – scanning the drive and looking for lost data may take much longer than you expect.

All tools have passed the first test and showed good results.

In the next part of the test, we’re going to erase main elements of the file system structure, one after another: a Superblock, then Group Descriptors Table, and see what happens.

The Superblock erased

In the second test, we erased the Superblock.

Superblock is the block that stores metadata of the file system.

Similarly to Inodes storing file metadata, the Superblock stores file system metadata. If a superblock gets damaged, the file system will become inoperable.

This is the data stored inside a Superblock:

Number of blocks in the file system
Number of free blocks in the file system
Number of inodes in a group of blocks
Blocks in a group of blocks
Number of times when file system was launched since the last fsck checkup
UUID of this file system
File system condition (any errors detected, correct/incorrect unmounting etc.)
File system type
Operating system in which this file system was formatted
Time when the file system was last mounted
Time when the last record was made
Superblock is an element of vital importance for the file system, that is why every group of blocks contains a copy of the superblock.

The search algorithm used in our product lets you recover data easily even when the file system structure is damaged.

Hetman Partition Recovery allows us to analyze the disk space with the signature analysis algorithm. Analyzing the storage device sector by sector, the program finds certain byte sequences, skips lost elements of the chain, and represents the data to the user. If the entire file system structure is erased but level 0 folders are still there, data recovery is still possible and our program will do its best to display and recover it.

Now let’s see how it works in real life.

Top Data Recovery Tools for Linux File Systems – Ext4/3/2