File systems · Ext4 volume
Ext4 file recovery on Linux
How should I recover deleted files from Ext4?
Short answer
First unmount the volume and do not mount it read-write again: that can replay the journal and change what is left. Create an image with ddrescue or dd, then work on that image with Ext4-aware tools such as ext4magic, or carve it with PhotoRec. File Recovery Hero does not parse Ext4 metadata or run on Linux.
The situation
Files were deleted from a Linux disk or the volume no longer mounts normally.
Files were deleted from a Linux disk or the volume no longer mounts normally. If the original source has not been written to again, useful file-system traces or data blocks may still remain for Ext4 volume. A read-only scan can assess the source, but no result should be promised before that examination.
01 / Diagnose
Work out what actually disappeared
Ext4 journals and inode structures require file-system-specific tools. Mounting read-write can replay a journal and change the evidence. For Ext4 volume, first separate a missing path, folder or volume name from actual deletion. That distinction determines the safest next recovery step.
Check the last known path, trash and backups without writing to the original device.
02 / Protect the source
Preserve the best recovery chance
- 1
Disconnect or remove Ext4 volume and prevent further writes.
- 2
Write down the device, the date and the last action before the loss so you can match recovered files later.
- 3
Check known destinations, backups and trash without restoring anything onto the source.
- 4
Export every candidate only to internal storage or a physically different drive.
Unmount the volume, image it and use an Ext4-aware workflow. File Recovery Hero does not currently parse Ext4 metadata. Do not record a test file and do not approve formatting or file-system repair.
03 / Choose the method
Match the tool to the source
For stable, readable exFAT, NTFS and FAT16/FAT32 or uncompressed IMG, DD, RAW and BIN images.
Unconfirmed exports are marked .UNVERIFIED.
Software cannot reconstruct overwritten blocks or storage cells that are no longer readable. If the source disconnects repeatedly or becomes unusually warm, a professional laboratory is the safer route.
04 / Verify
Check the recovered content, not just its name
Validate files recovered from Ext4 volume completely: compare the size and format, then read the content from beginning to end. A preview or surviving filename is not proof of a complete recovery.
Keep the source until two verified copies exist. One working preview is not enough.
Sources and technical references
FAQ
Questions about this recovery case
Can Ext4 volume be recovered in this situation?+
Files were deleted from a Linux disk or the volume no longer mounts normally. If the original source has not been written to again, useful file-system traces or data blocks may still remain for Ext4 volume. A read-only scan can assess the source, but no result should be promised before that examination. The result still depends on what remains readable on the source.
What should I avoid before scanning?+
Unmount the volume, image it and use an Ext4-aware workflow.
Does scanning write to my memory card?+
Your memory card is only read. Nothing is saved to it.
How do I know whether the result is complete?+
Validate files recovered from Ext4 volume completely: compare the size and format, then read the content from beginning to end.