Undelete files on an ext3 filesystem

[Alexander Holst]

Hi,

this is a more theoretical question, as fourtunately, I do not have the
urge to undelete something at all, but tried some stuff in order to be
prepared for the worst case.

I read both HOWTOs about undeleting files on ext2 filesystems, which can
be found on TLDP. But none of the mentioned methods reveal anything that
was deleted on an ext3 fs.

Is it possible at all?

I created a directory structure with aproximately 1.000 directories and
about 65.000 files for testing purposes. Most of the files were more
than 48KB, so the more than 12 blocks dilemma would be forced upon me.
Through a Nautilus FileBrowser window, I deleted the top directory of
the tree and therefore all its contents along the way as well.

In order to make it worse, I rebooted the machine twice and logged in as
the user who previously deleted files in his homefolder, before
unmounting the filesystem with the "accidentally" deleted files - the
filesystem in question is the /home partition (I wanted to have a
typical setup ;).

Running debugfs and trying to find any deleted inodes as mentioned in
the HOWTOs revealed none at all! Shouldn't there be like more than
65.000 deleted inodes by now? Even the undelete feature of mc didn't
show any deleted files for the fs in question. Would I have to consult
the journal of the fs in some fashion - and if, how?

Is there any chance to recover at least a fraction of the deleted data
in any way in an above described scenario? There has been almost no
writing to the filesystem, except for the logins of the user, so
actually the data of almost all the deleted files should be still
untouched and therefore recoverable - unless I misunderstood the concept
of filesystems and their behaviour - which could be very well possible
=;)

Any ideas/suggestions welcome ;)

Greetings,
Alex

-- 
Alexander Holst
Hergulesse Design
ph: +49 [0]711 887 5195
fx: +49 [0]711 887 5196
<alex.holst [at] hergulesse [dot] de>
<hergulesse [at] s.netic [dot] de>