Read this article to learn more about top tools to recover data lost from partitions on a disk with Ext4/3/2 file system used by Linux. We will explore thoroughly what each data recovery tool can do.
By default, most modern Linux distributives use the Ext4 file system, in the same way as older distributives typically used Ext3 or Ext2 file systems, and the whole thing started one day in the past with them using the original Ext system.
One of the features within Ext2 is that the file system removes partially the information about deleted files, in particular, links to file names, which makes recovering such file names an almost impossible task. Journaled file systems Ext3 and Ext4 perform the deleting operations via the journal. The probability of recovering data from such systems depends largely on the size of the journal and on how long the operating system worked after a certain file was deleted. That is why it’s important to take immediate action right after you discover important information was lost. In our case, immediate action means you should stop writing data to the disk from where the important information was removed, and find a reliable app to help you bring the files back.
We have selected some of the most popular data recovery solutions which you may wish to use, and conducted a few tests. Below, we will present the test results for each tool.
Read this article to find out which of them can do better when it comes to recovering lost information from the hard disk.
Before we start testing various tools, let’s explore the structure of these file systems.
This file system contains a bootloader which consists of a series of block groups.
The structure of each group begins with a Superblock followed by Group Descriptors, then followed by Block Bitmap, then by Inode bitmap, then by Inode table, and the final element is Data, that is, the information stored in a volume.
Ext4 has evolved from Ext3, the most popular file system for Linux. In many aspects, Ext4 means more progress from Ext3, than Ext3 did in comparison with Ext2. The most significant improvement in Ext3 versus Ext2 was the introduction of “journaling,” while Ext4 brings more changes to important system structures, such as those meant to store file data.
It allowed to create a more advanced file system, with a performance boost, a wider range of functions and at the same time, with more stability.
At the moment, the maximal Ext3 file system size is 16 terabytes, and file size is limited to 2 terabytes. Ext4 adds 48-bit block addressing which means that the maximal file system size is now 1 exabyte, and it can hold files as large as 16 terabytes each. 1 EB (exabyte) = 1,048,576 TB (terabyte), 1 EB = 1024 PB (petabyte), 1 PB = 1024 TB, 1 TB = 1024 GB. Why 48-bit, and not 64-bit, you may ask? There was a number of restrictions that had to be removed in order to make Ext4 a completely 64-bit file system, but Ext4 was not designed with 64-bit structure in mind, though. Data structures in Ext4 were created with consideration of the required changes.
Currently, a single directory in Ext3 cannot contain more than 32,000 subdirectories. Ext4 gets rid of that restriction and lets you create an unlimited number of subdirectories.
The latest file system, Ext4, has the design of a B-tree. That is why the data is stored in the tree’s leaves, and in order to access the information, a data recovery tool has to go down the chain of links before restoring any files.
If some elements of this chain are removed, there are chances that the data recovery tool won’t be able to find the path to your data. In today’s tests, we will try deleting some elements of the file system structure and find out how best data recovery tools can cope with the problem.
Tests and benchmarks for data recovery tools
In Windows, you need a specialized utility or a special driver to view the contents of a disk formatted into EXT4/3/2. Fortunately, data recovery tools can help you view the contents of such devices and restore data from them.
For our benchmarking assessment, we have selected several popular data recovery tools such as Hetman Partition Recovery, R-Studio, EaseUs Data Recovery Wizard, Recuva and DiskDrill. After a preliminary round of testing we had to exclude one of the participants – Recuva – because it could find only a small portion of files on an Ext 4 drive. Being able to recover only 20% of the lost data, it is evidently the tool least suitable for the job, so we decided to remove it from the list. Even when we gave it another chance and ran the test for the second time, it wasn’t able to find virtually anything.
All right, let’s get down to testing.
On a computer running a Linux operating system, we’ve created a test disk with Ext4 file system. We copied some data to the disk – pictures, videos, and documents. After that, a part of the data was removed, and the disk was unmounted.
All further tests in data recovery were conducted on a Windows 10 computer.
After connecting the test disk with Ext4 file system, Windows 10 can’t recognize this file system, and when the disk is connected, the operating system suggests formatting it.
However, in fact there is no need to format anything – start the first utility on the list, Hetman Partition Recovery and scan the disk.
The program can recognize the disk, detect its file system and display its name and size properly.
For starters, we only run Fast scan, and it appears to be enough to gain good results.
Here’s the result: 2 folders and 20 files are found.
Evidently, this tool has no difficulty in finding the files deleted in such a way. We didn’t have to use Full analysis, and it saved us a lot of time.
Removed data is marked with a red cross. All the files can be previewed and recovered without effort. The disk structure is retained, so all files and folders can be located in a second: it makes searching for specific data extremely easy.
The program has completed this test successfully and met the challenge just as we expected. All deleted files could be recovered.
R-Studio can also recognize the test disk, detect its file system and display its name and size properly.
The program has found all the files, and their contents can be previewed.
However, it doesn’t apply to documents.
The disk structure and file names are retained. However, after a quick scan it can’t display contents of the documents.
In the end, even a deeper scan hasn’t changed anything.
This tool has passed the test too, but it has some difficulties in displaying documents. All deleted files have been recovered.
EaseUs Data Recovery Wizard can display the drive, recognize its name and size. However, the file system type is not displayed.
When we try to analyze the disk the program switches to Advanced Scan at once.
It has found all the files, but the disk structure is lost as well as file names, and all the files are sorted by file type into separate folders. The program seems to be checking the disk with in-depth analysis, so it’s going to take a long time if you’re working with high-capacity drives.
In the end, the program has found all the files and sorted them by file type into folders. All documents are located, and they can be previewed.
As to video files, one of them is damaged.
All the photos are present.
Unfortunately, deleted files have no markings to distinguish them from the files which are still on the disk. The only way to tell if all files are present is by counting them. As you can guess, finding the file you need is going to be quite a challenge when there are many of them on the disk, and it will take a long time to view every file. The program has completed this test successfully, and only one video file couldn’t be recovered.
Disk Drill recognizes the test disk, displays its name and size.
When choosing the scan type, Quick Scan is not available, so we had to run the Deep Scan.
Deep Scan results:
The program has found the data, but couldn’t restore the disk structure or the file names, and sorted the files into folders by file type.
All the photos are present, and their contents can be previewed.
One video file is damaged.
The program has found all the documents, and their contents can be previewed.
It has coped with the task successfully, although it took quite a long time to complete the scan; this may become a serious issue when you work with a high-capacity drive containing a number of files – scanning the drive and looking for lost data may take much longer than you expect.
All tools have passed the first test and showed good results.
In the next part of the test, we’re going to erase main elements of the file system structure, one after another: a Superblock, then Group Descriptors Table, and see what happens.
In the second test, we erased the Superblock.
Superblock is the block that stores metadata of the file system.
Similarly to Inodes storing file metadata, the Superblock stores file system metadata. If a superblock gets damaged, the file system will become inoperable.
This is the data stored inside a Superblock:
The search algorithm used in our product lets you recover data easily even when the file system structure is damaged.
Hetman Partition Recovery allows us to analyze the disk space with the signature analysis algorithm. Analyzing the storage device sector by sector, the program finds certain byte sequences, skips lost elements of the chain, and represents the data to the user. If the entire file system structure is erased but level 0 folders are still there, data recovery is still possible and our program will do its best to display and recover it.
Now let’s see how it works in real life.
After erasing the Superblock – Hetman Partition Recovery displays the test disk, its name and file system type.
After the fast scan, the picture hasn’t changed at all.
The program finds all the data, and you can use the preview window to see the file contents.
We managed to recover all the information.
The program has coped with the task successfully, even without running a full analysis.
The disk structure and file names are retained, all files can be previewed.
The second test is passed.
R-Studio can also recognize the disk, and display its name and file system type.
It shows the same result as in the previous test: all the files are detected, but the contents of the documents can’t be displayed.
Running a deeper scan doesn’t change anything.
The disk structure and file names are retained, all data is present, so this program has also passed the test. The only downside is that there is no way to view the contents of the documents.
EaseUs – just like in the previous test, the program can recognize the disk but doesn’t display its file system type.
After scanning, nothing happens: just like before, files are sorted into folders, no disk structure, no file names, but at least file contents can be displayed.
One video file is damaged, and couldn’t be recovered.
The program has completed the second test successfully, with only minor issues.
Disk Drill – the program can display the disk, recognize its name and size. Quick scan is not available for this device.
The Deep scan result is the same as in the first test. No disk structure, file names are lost, but all data is present and can be previewed.
One video couldn’t be recovered at all.
In the next test, we erased the main descriptor table of a group of blocks.
Each group of blocks in a file system has one descriptor connected to such group. Group descriptors are the second element in a group of blocks. In a standard configuration, every group of blocks contains a full copy of the descriptor table.
This table stores information on the descriptors, which, in their turn, store information about attributes and physical location of files.
This information is a sequence of 32-bit numbers of blocks which contain file data.
Results of the test we have conducted after removing the main descriptor table are described below.
Hetman Partition Recovery has passed this test without any changes from its results in the previous two tests.
The disk structure and file names are retained, all files can be recovered. The program was able to find all data even with Fast scan only.
R-Studio shows the same result as in the previous tests.
The disk structure and file names are retained, just the contents of the documents can’t be displayed.
Still, the program managed to recover them in the end.
Testing EaseUs Data Recovery Wizard
The result of EaseUs hasn’t changed, either.
The disk structure and file names are lost.
One video file can’t be recovered.
In the third test, Disk Drill is the one with the poorest result. The program failed to find the majority of files – even those that haven’t been removed.
However, it suggested scanning the entire disk which might improve the chances of finding the lost data.
And truly, after analyzing the entire disk it managed to find the lost data.
In the end, R-Studio shows the same result as in the previous tests.
Though one video file is damaged, we managed to recover it, but the most part of its contents has been erased anyway.
All in all, this program has also passed the test, though it took more time than we expected.
Now let’s draw the bottom line. All the programs have passed the three tests, but with different results.
Hetman Partition Recovery managed to find all files, the disk structure and file names are retained.
R-Studio also detected all files, retained the disk structure and file names; although documents can’t be previewed, we can still recover them.
EaseUs found all files too, but failed to keep the disk structure; all files are sorted into folders by type, but their names are not displayed anymore. One video couldn’t be recovered at all.
Finally, Disk Drill it managed to locate all files, but it couldn’t display the disk structure and file names. One video file is damaged, but we managed to recover it, but the most part of its contents has been erased anyway.
All right, now that you’ve seen the results, it’s easier to decide which tool to choose for recovering your information, and which one is better suited for your needs. The choice is yours, after all… but
There is only one thing I’d like to add: the algorithm used in our product allows to retain the folder structure and file names which makes it easier to search for certain data and saves your time. In addition, our program lets you create a disk image and then recover data from there, which is the industry standard for dealing with faulty drives.
Some programs that we have tested today don’t have this feature. The algorithm used in our product lets you recover data even if the entire structure of the file system is erased, and if the disk has at least some data left, Hetman Partition Recovery can restore it and display it to you thanks to using signature analysis. The program supports the following file systems: FAT/exFAT, NTFS/ReFS, APFS/HFS+, Ext2/3/4/ReiserFS and XFS/UFS. You can recover lost information from disks formatted under Windows, MacOS, Linux and Unix.
See the full article with all additional video tutorials. If you still have any questions, please ask in a comments. Also visit our Youtube channel, there are over 400 video tutorials.
Introduction
By default, most modern Linux distributives use the Ext4 file system, in the same way as older distributives typically used Ext3 or Ext2 file systems, and the whole thing started one day in the past with them using the original Ext system.
One of the features within Ext2 is that the file system removes partially the information about deleted files, in particular, links to file names, which makes recovering such file names an almost impossible task. Journaled file systems Ext3 and Ext4 perform the deleting operations via the journal. The probability of recovering data from such systems depends largely on the size of the journal and on how long the operating system worked after a certain file was deleted. That is why it’s important to take immediate action right after you discover important information was lost. In our case, immediate action means you should stop writing data to the disk from where the important information was removed, and find a reliable app to help you bring the files back.
We have selected some of the most popular data recovery solutions which you may wish to use, and conducted a few tests. Below, we will present the test results for each tool.
Read this article to find out which of them can do better when it comes to recovering lost information from the hard disk.
- Hetman Partition Recovery;
- R-Studio;
- EaseUs Data Recovery Wizard;
- Disk Drill;
File system structure and the algorithm used to find the lost data
Before we start testing various tools, let’s explore the structure of these file systems.
This file system contains a bootloader which consists of a series of block groups.
The structure of each group begins with a Superblock followed by Group Descriptors, then followed by Block Bitmap, then by Inode bitmap, then by Inode table, and the final element is Data, that is, the information stored in a volume.
Ext4 has evolved from Ext3, the most popular file system for Linux. In many aspects, Ext4 means more progress from Ext3, than Ext3 did in comparison with Ext2. The most significant improvement in Ext3 versus Ext2 was the introduction of “journaling,” while Ext4 brings more changes to important system structures, such as those meant to store file data.
It allowed to create a more advanced file system, with a performance boost, a wider range of functions and at the same time, with more stability.
At the moment, the maximal Ext3 file system size is 16 terabytes, and file size is limited to 2 terabytes. Ext4 adds 48-bit block addressing which means that the maximal file system size is now 1 exabyte, and it can hold files as large as 16 terabytes each. 1 EB (exabyte) = 1,048,576 TB (terabyte), 1 EB = 1024 PB (petabyte), 1 PB = 1024 TB, 1 TB = 1024 GB. Why 48-bit, and not 64-bit, you may ask? There was a number of restrictions that had to be removed in order to make Ext4 a completely 64-bit file system, but Ext4 was not designed with 64-bit structure in mind, though. Data structures in Ext4 were created with consideration of the required changes.
Currently, a single directory in Ext3 cannot contain more than 32,000 subdirectories. Ext4 gets rid of that restriction and lets you create an unlimited number of subdirectories.
The latest file system, Ext4, has the design of a B-tree. That is why the data is stored in the tree’s leaves, and in order to access the information, a data recovery tool has to go down the chain of links before restoring any files.
If some elements of this chain are removed, there are chances that the data recovery tool won’t be able to find the path to your data. In today’s tests, we will try deleting some elements of the file system structure and find out how best data recovery tools can cope with the problem.
Tests and benchmarks for data recovery tools
In Windows, you need a specialized utility or a special driver to view the contents of a disk formatted into EXT4/3/2. Fortunately, data recovery tools can help you view the contents of such devices and restore data from them.
For our benchmarking assessment, we have selected several popular data recovery tools such as Hetman Partition Recovery, R-Studio, EaseUs Data Recovery Wizard, Recuva and DiskDrill. After a preliminary round of testing we had to exclude one of the participants – Recuva – because it could find only a small portion of files on an Ext 4 drive. Being able to recover only 20% of the lost data, it is evidently the tool least suitable for the job, so we decided to remove it from the list. Even when we gave it another chance and ran the test for the second time, it wasn’t able to find virtually anything.
All right, let’s get down to testing.
On a computer running a Linux operating system, we’ve created a test disk with Ext4 file system. We copied some data to the disk – pictures, videos, and documents. After that, a part of the data was removed, and the disk was unmounted.
All further tests in data recovery were conducted on a Windows 10 computer.
Testing Hetman Partition Recovery
After connecting the test disk with Ext4 file system, Windows 10 can’t recognize this file system, and when the disk is connected, the operating system suggests formatting it.
However, in fact there is no need to format anything – start the first utility on the list, Hetman Partition Recovery and scan the disk.
The program can recognize the disk, detect its file system and display its name and size properly.
For starters, we only run Fast scan, and it appears to be enough to gain good results.
Here’s the result: 2 folders and 20 files are found.
Evidently, this tool has no difficulty in finding the files deleted in such a way. We didn’t have to use Full analysis, and it saved us a lot of time.
Removed data is marked with a red cross. All the files can be previewed and recovered without effort. The disk structure is retained, so all files and folders can be located in a second: it makes searching for specific data extremely easy.
The program has completed this test successfully and met the challenge just as we expected. All deleted files could be recovered.
Testing R-Studio
R-Studio can also recognize the test disk, detect its file system and display its name and size properly.
The program has found all the files, and their contents can be previewed.
However, it doesn’t apply to documents.
The disk structure and file names are retained. However, after a quick scan it can’t display contents of the documents.
In the end, even a deeper scan hasn’t changed anything.
This tool has passed the test too, but it has some difficulties in displaying documents. All deleted files have been recovered.
Testing EaseUs Data Recovery Wizard
EaseUs Data Recovery Wizard can display the drive, recognize its name and size. However, the file system type is not displayed.
When we try to analyze the disk the program switches to Advanced Scan at once.
It has found all the files, but the disk structure is lost as well as file names, and all the files are sorted by file type into separate folders. The program seems to be checking the disk with in-depth analysis, so it’s going to take a long time if you’re working with high-capacity drives.
In the end, the program has found all the files and sorted them by file type into folders. All documents are located, and they can be previewed.
As to video files, one of them is damaged.
All the photos are present.
Unfortunately, deleted files have no markings to distinguish them from the files which are still on the disk. The only way to tell if all files are present is by counting them. As you can guess, finding the file you need is going to be quite a challenge when there are many of them on the disk, and it will take a long time to view every file. The program has completed this test successfully, and only one video file couldn’t be recovered.
Testing Disk Drill
Disk Drill recognizes the test disk, displays its name and size.
When choosing the scan type, Quick Scan is not available, so we had to run the Deep Scan.
Deep Scan results:
The program has found the data, but couldn’t restore the disk structure or the file names, and sorted the files into folders by file type.
All the photos are present, and their contents can be previewed.
One video file is damaged.
The program has found all the documents, and their contents can be previewed.
It has coped with the task successfully, although it took quite a long time to complete the scan; this may become a serious issue when you work with a high-capacity drive containing a number of files – scanning the drive and looking for lost data may take much longer than you expect.
All tools have passed the first test and showed good results.
In the next part of the test, we’re going to erase main elements of the file system structure, one after another: a Superblock, then Group Descriptors Table, and see what happens.
The Superblock erased
In the second test, we erased the Superblock.
Superblock is the block that stores metadata of the file system.
Similarly to Inodes storing file metadata, the Superblock stores file system metadata. If a superblock gets damaged, the file system will become inoperable.
This is the data stored inside a Superblock:
- Number of blocks in the file system
- Number of free blocks in the file system
- Number of inodes in a group of blocks
- Blocks in a group of blocks
- Number of times when file system was launched since the last fsck checkup
- UUID of this file system
- File system condition (any errors detected, correct/incorrect unmounting etc.)
- File system type
- Operating system in which this file system was formatted
- Time when the file system was last mounted
- Time when the last record was made
- Superblock is an element of vital importance for the file system, that is why every group of blocks contains a copy of the superblock.
The search algorithm used in our product lets you recover data easily even when the file system structure is damaged.
Hetman Partition Recovery allows us to analyze the disk space with the signature analysis algorithm. Analyzing the storage device sector by sector, the program finds certain byte sequences, skips lost elements of the chain, and represents the data to the user. If the entire file system structure is erased but level 0 folders are still there, data recovery is still possible and our program will do its best to display and recover it.
Now let’s see how it works in real life.
Testing Hetman Partition Recovery
After erasing the Superblock – Hetman Partition Recovery displays the test disk, its name and file system type.
After the fast scan, the picture hasn’t changed at all.
The program finds all the data, and you can use the preview window to see the file contents.
We managed to recover all the information.
The program has coped with the task successfully, even without running a full analysis.
The disk structure and file names are retained, all files can be previewed.
The second test is passed.
Testing R-Studio
R-Studio can also recognize the disk, and display its name and file system type.
It shows the same result as in the previous test: all the files are detected, but the contents of the documents can’t be displayed.
Running a deeper scan doesn’t change anything.
The disk structure and file names are retained, all data is present, so this program has also passed the test. The only downside is that there is no way to view the contents of the documents.
Testing EaseUs Data Recovery Wizard
EaseUs – just like in the previous test, the program can recognize the disk but doesn’t display its file system type.
After scanning, nothing happens: just like before, files are sorted into folders, no disk structure, no file names, but at least file contents can be displayed.
One video file is damaged, and couldn’t be recovered.
The program has completed the second test successfully, with only minor issues.
Testing Disk Drill
Disk Drill – the program can display the disk, recognize its name and size. Quick scan is not available for this device.
The Deep scan result is the same as in the first test. No disk structure, file names are lost, but all data is present and can be previewed.
One video couldn’t be recovered at all.
The main descriptor table of a group of blocks is removed
In the next test, we erased the main descriptor table of a group of blocks.
Each group of blocks in a file system has one descriptor connected to such group. Group descriptors are the second element in a group of blocks. In a standard configuration, every group of blocks contains a full copy of the descriptor table.
This table stores information on the descriptors, which, in their turn, store information about attributes and physical location of files.
This information is a sequence of 32-bit numbers of blocks which contain file data.
Results of the test we have conducted after removing the main descriptor table are described below.
Testing Hetman Partition Recovery
Hetman Partition Recovery has passed this test without any changes from its results in the previous two tests.
The disk structure and file names are retained, all files can be recovered. The program was able to find all data even with Fast scan only.
Testing R-Studio
R-Studio shows the same result as in the previous tests.
The disk structure and file names are retained, just the contents of the documents can’t be displayed.
Still, the program managed to recover them in the end.
Testing EaseUs Data Recovery Wizard
The result of EaseUs hasn’t changed, either.The disk structure and file names are lost.
One video file can’t be recovered.
Testing Disk Drill
In the third test, Disk Drill is the one with the poorest result. The program failed to find the majority of files – even those that haven’t been removed.
However, it suggested scanning the entire disk which might improve the chances of finding the lost data.
And truly, after analyzing the entire disk it managed to find the lost data.
In the end, R-Studio shows the same result as in the previous tests.
Though one video file is damaged, we managed to recover it, but the most part of its contents has been erased anyway.
All in all, this program has also passed the test, though it took more time than we expected.
Conclusion
Now let’s draw the bottom line. All the programs have passed the three tests, but with different results.
Hetman Partition Recovery managed to find all files, the disk structure and file names are retained.
R-Studio also detected all files, retained the disk structure and file names; although documents can’t be previewed, we can still recover them.
EaseUs found all files too, but failed to keep the disk structure; all files are sorted into folders by type, but their names are not displayed anymore. One video couldn’t be recovered at all.
Finally, Disk Drill it managed to locate all files, but it couldn’t display the disk structure and file names. One video file is damaged, but we managed to recover it, but the most part of its contents has been erased anyway.
All right, now that you’ve seen the results, it’s easier to decide which tool to choose for recovering your information, and which one is better suited for your needs. The choice is yours, after all… but
There is only one thing I’d like to add: the algorithm used in our product allows to retain the folder structure and file names which makes it easier to search for certain data and saves your time. In addition, our program lets you create a disk image and then recover data from there, which is the industry standard for dealing with faulty drives.
Some programs that we have tested today don’t have this feature. The algorithm used in our product lets you recover data even if the entire structure of the file system is erased, and if the disk has at least some data left, Hetman Partition Recovery can restore it and display it to you thanks to using signature analysis. The program supports the following file systems: FAT/exFAT, NTFS/ReFS, APFS/HFS+, Ext2/3/4/ReiserFS and XFS/UFS. You can recover lost information from disks formatted under Windows, MacOS, Linux and Unix.
See the full article with all additional video tutorials. If you still have any questions, please ask in a comments. Also visit our Youtube channel, there are over 400 video tutorials.
