Re: Help!!! undelete for ext3fs!!!
On Fri, Mar 01, 2002 at 08:38:05PM +0100, Paul Seelig wrote:
> On Thu, Feb 28, 2002 at 11:42:36PM -0600, Cheryl Homiak wrote:
>
> > I just deleted something I didn't want to delete; won't hurt my system,
> > just destroyed some important records I was keeping.
> >
> *Immediately* unmount the partition holding this data! With
> "*immediately*" i mean *IMMEDIATELY!*, or better put, RIGHT *NOW*!
>
> An now let's just calm down to be able to think for a minute.
A few days ago my fingers typed the command `apt-get clean'. What my
brain intended was `apt-get autoclean'. Fortunately, I keep package
files on a separate ext2 partition so unmounting it was quick and easy.
I realise the deleted data are replaceable but 400M+ takes a long time to
download on a modem link so I took the opportunity to have a look at how
easy or hard it was to recover the files. If I failed to get them back
it wouldn't be disastrous but it was annoying to have made a mistake
with a command I was familiar with.
> > Is there any way to undelete in ext3fs?
> >
> Since this is compatible with ext2, ext2 undeletion should be
> possible. Now you have the possibility to find out yourself and tell
> us whether this worked or not.
The man page for Midnight Commander claims that undeletion is possible
only with an ext2 file system. Your suggestion to explore whether it
would deal with ext3 is reasonable but doesn't mc use debugfs which is
designed for an ext2 file system?
> There is a comfortable way for undeletion using the GNU Midnight
> Commander, "/usr/bin/mc". If you have it installed, then start it up,
> press "F9" and choose "Command | Undelete files (ext2fs only)".
>
> Enter the device file name without the leading "/dev/" of the
> (hopefully unmounted!) partition containing the deleted files and
> wait a few minutes until the panel contains a listing of deleted
> files. Depending on size of the partition in question, this can take
> up a considerable amount of time. So please be patient even if this
> takes half an hour or even far more.
I was aware that Midnight Commander has the facility you describe so I
used it. It told me it was `loading deleted files information' and was
still going strong after an hour. I went to bed, dreamt of inodes, got
up and there it was still churning away. Now that partition only has
about 50M of free space so I suspect there is insufficient room to write
the undeleted files to it. A way to direct the file listing somewhere
else would be useful.
> The files in the resulting list don't carry names anymore and the
> shown names are probably mere inode numbers(?) or similar. Check
> which file(s) might contain the data in question and copy this file
> into a directory located on *another* partition.
Imagine a lot of .deb files. Imagine having to rename them correctly!
The tedium involved, however, is very much offset by the pleasure of
recovering them.
> And if you've been able to save your data: Rejoice!
Eventually I used the recover package from the testing distribution.
You can select deleted files by date and time of deletion and dump them
to a directory on another partition. It was also quite quick. Having
read about the difficulty of undeleting files on unix systems I found
the performance of this program impressive.
[Snip good advice on backups]
Brian.
Reply to: