Re: ext3 undelete/recovery
Alvin Oga <aoga <at> ns.Linux-Consulting.com> writes:
>
> On Fri, 7 Jan 2005, Alban Browaeys wrote:
>
> > I just wanted this to be somewhere , seems it s not worst a place than any
other.
> >
> > With ext3 you cannot undelete a file .
>
> out of curiousity, which undelete tools did you use ??
>
> underneath ext3 is an ext2 fs ... so i dumb/unexperienced commentary is
> that i should be able to undelete ext2 files ( esp if i turned off ext3 to
> do the undeleting ? )
>
> > That s right. But only if it was delete
> > in a proper way, for example with rm .
>
Undelete tools : recover,
debugfs : http://www.praeclarus.demon.co.uk/tech/e2-undel/html/howto-8.html
mc: http://www.stearns.org/doc/file-recovery.v0.81.html
When you rm a file, ext3 take extra steps that prevents those tools from finding
deleted data. There is still a way to undelete, grep the filesystem/partition :
grep /dev/hda1 for example, but that s a no go for most people.
http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html
Q: How can I recover (undelete) deleted files from my ext3 partition?
"
In order to ensure that ext3 can safely resume an unlink after a crash, it
actually zeros out the block pointers in the inode, whereas
ext2 just marks these blocks as unused in the block bitmaps and marks the inode
as "deleted" and leaves the block pointers alone.
Your only hope is to "grep" for parts of your files that have been deleted and
hope for the best.
"
Alban
Reply to: