Re: Best file system
On Wednesday 01 February 2006 16:26, Sylvestre Ledru wrote:
> > At least one admin was able to mount an ext3 partion as ext2 and then
> > undelete files from there. Sounds like a crazy idea, and it might be too
> > late depending on what you've attempted already:
> > http://lists.debian.org/debian-user/2005/01/msg00840.html
> > http://lists.debian.org/debian-user/2005/01/msg00885.html
>
> In this case, the guy has been able to undelete files when they are lost
> during a fsck (which is not my case).
Yes, but I wanted to point out the crazy idea for you anyway in case it
gets you somewhere.
> > Also, the straight 'dd' doesn't actually copy everything, but
> > hopefully it got what you needed. For next time, have a look at dcfldd,
> > which supposedly does a much better job (and thus takes longer to copy):
> > http://dcfldd.sourceforge.net/
>
> OK, thanks, I will try with this one.
You've essentially got something similar to a computer forensics problem on
your hands. The best thing that I found thusfar for these situation is a
Helix Live cd, which is based on Knoppix [it also contains dcfldd, BTW] :
http://www.e-fense.com/helix/
There are a number of good documents in the 'Documents' section, too.
If it's possible, I suggest making two dcfldd images of the data so that
you can freely work on one of the copies and overwrite it again with a
'fresh' copy if needed.
Best of luck.
- Chris
--
Chris Knadle
Chris.Knadle@coredump.us
Reply to: