Re: fsck on ext3, lost files
Gary Parker wrote:
> I've searched every file in lost+found with a few different tools: gqview,
> nautilus, lde, find with file. Although I found some of my files in various
> directories in lost+found, there are a couple of directories whose files are
> nowhere to be found there.
[...]
> Is it possible in an ext3 file system to find files outside of lost+found?
It depends. When a file is deleted (or lost), the data remains on disk.
The difference is that the kernel does no longer know that the data is
there, and treats it as free space, so it can be overwritten at any
given time. Chances of that happening increase as you do something with
the disk. Even mounting it in read-write mode may be enough to lose this
data, as there are processes invisible to user that update the file
system from time to time.
You did mount it read-only as in...
mount -o ro /dev/disk /mnt/location
...did not you?
> I am guessing that it is not possible since lde shows these directories as empty
> then I am out of luck, e.g.,
[...]
> I can retrieve the .jedrc file but there is nothing to be found of the pictures
> directory in lost+found.
The "testdisk" package, I have already mentioned contains a tool called
"PhotoRec" [1] that might just do the trick. There is also "foremost"
package that may be useful.
[1] http://www.cgsecurity.org/wiki/PhotoRec
Reply to: