[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Best file system

On Wednesday 01 February 2006 16:26, Sylvestre Ledru wrote:
> >    At least one admin was able to mount an ext3 partion as ext2 and then
> > undelete files from there.  Sounds like a crazy idea, and it might be too
> > late depending  on what you've attempted already:
> > 	http://lists.debian.org/debian-user/2005/01/msg00840.html
> > 	http://lists.debian.org/debian-user/2005/01/msg00885.html
> In this case, the guy has been able to undelete files when they are lost
> during a fsck (which is not my case).

   Yes, but I wanted to point out the crazy idea for you anyway in case it 
gets you somewhere.

> >    Also, the straight 'dd' doesn't actually copy everything, but
> > hopefully it got what you needed.  For next time, have a look at dcfldd,
> > which supposedly does a much better job (and thus takes longer to copy):
> > 	http://dcfldd.sourceforge.net/
> OK, thanks, I will try with this one.

   You've essentially got something similar to a computer forensics problem on 
your hands.  The best thing that I found thusfar for these situation is a 
Helix Live cd, which is based on Knoppix [it also contains dcfldd, BTW] :

   There are a number of good documents in the 'Documents' section, too.

   If it's possible, I suggest making two dcfldd images of the data so that 
you can freely work on one of the copies and overwrite it again with a 
'fresh' copy if needed.

   Best of luck.
	- Chris


Chris Knadle

Reply to: