Re: URGENTE!!! Recuperar archivos borrados

[Gunnar Wolf <gwolf@gwolf.cx>]

rael dijo [Tue, Oct 28, 2003 at 05:10:31PM +0100]:
>   Accidentalmente he eliminado con userdel -r a un usuario del sistema. 
> Necesito recuperar sus datos urgentemente. El sistema de ficheros es 
> ext3, con raid 0 bajo woody. He parado el raid y he desmontado la 
> particion para que no se sobreescriba nada. He leido sobre el recover 
> pero parece ser que bajo ext3 da problemas. Necesito  ayda.
> 
> Gracias por adelantado.

En efecto.

Yo mantengo recover. Recover funciona bien (tan bien como el FS lo
permite) bajo ext2. Ext3 hace las cosas de manera muy diferente, y no
hay manera de que recover (o ninguna otra herramienta que funcione a
través de debugfs) te va a poder ayudar.

Te adjunto a este mensaje el archivo README.ext2only que agregué a
recover cuando lo adopté (no lo tendrás si tienes Woody), explica un
poco el por qué no funciona con ext3 y te da una idea de qué puedes
hacer al respecto.

Saludos,

-- 
Gunnar Wolf - gwolf@gwolf.cx - (+52-55)5630-9700 ext. 1366
PGP key 1024D/8BB527AF 2001-10-23
Fingerprint: 0C79 D2D1 2C4E 9CE4 5973  F800 D80E F35A 8BB5 27AF

Why does recover only work on true ext2 filesystems
===================================================
                (and not on ext3)

Note: This text was shamesly taken and slightly adapted from the text
found in the e2undel package. Thank Javier Fernández-Sanguino for the
information ;-)

If you delete a file stored on an ext2 file system, its data is
not instantly lost. What happens is:

·  ext2 marks the file's data blocks as available in its block
   bitmap

·  ext2 marks the file's inode as available in its inode bitmap

·  ext2 sets the deletion time in the file's inode

·  ext2 invalidates the file's name in the directory entry

So, the file's data is not actually deleted (but it might be
overwritten in the future); and the crucial information in the inode
(owner, access rights, size, data blocks occupied by the file and some
more) is not touched. If you know the inode number, you can recover
the file by using Ted Ts'o's debugfs(8) tool.

What is lost however is the association between the file name and
the inode: You can't restore the former file name from the inode
information. To recover the data of a deleted file, you must
completely rely on the information in the inode like file size, owner,
deletion time, etc. ext3 behaves different from ext2 in one
regard: When a file is deleted, the information in the inode is also
removed. Tools like e2undel (or Ted T'so's debugfs(8)) that rely
on this information when undeleting files don't work anymore.

--------------------------------------------------------------------

If you have an important file you lost on an ext3 (or any other kind
of) partition, you can do as recommended by
http://recover.sourceforge.net/unix/ as the true Unix way:

grep -a -B[size before] -A[size after] 'text' /dev/[your_partition]

Replace [size before], [size after] and [your_partition] with
something meaningful.

e.g.: If you want to undelete a letter (+- 200 lines) starting with
"Hi mum" which was stored on /dev/hda1 you can try:

grep -a -B2 -A200 "Hi mum" /dev/hda1

Of course, this will only work for text or otherwise human-readable
files.