Re: ext3 undelete/recovery
hi ya alban
On Fri, 7 Jan 2005, Alban Browaeys wrote:
i assume the comment below is the "rm" command
> > > That s right. But only if it was delete
> > > in a proper way, for example with rm .
..
> When you rm a file, ext3 take extra steps that prevents those tools from finding
> deleted data. There is still a way to undelete, grep the filesystem/partition :
> grep /dev/hda1 for example, but that s a no go for most people.
as long as the data is intact, one could stitch the inode links
back together again ( with debugfs ? ) or any other tools
> http://batleth.sapienti-sat.org/projects/FAQs/ext3-faq.html
> Q: How can I recover (undelete) deleted files from my ext3 partition?
> "
> In order to ensure that ext3 can safely resume an unlink after a crash, it
> actually zeros out the block pointers in the inode,
which is okay if it left the (ascii) file contents intact
and one really wanted to undelet, it might still be possible in
some cases ..
thanx for the info...
have fun
alvin
Reply to: