Undelete files on an ext3 filesystem

[Norberto Quintanar]

In order to ensure that ext3 can safely resume an unlink after a
crash, it actually zeros out the block pointers in the inode, whereas
ext2 just marks these blocks as unused in the block bitmaps and marks
the inode as "deleted" and leaves the block pointers alone.

Your only hope is to "grep" for parts of your files that have been
deleted and hope for the best.


--- Alexander Holst <alex.holst@hergulesse.de> wrote:
> Hi,
> 
> this is a more theoretical question, as fourtunately, I do not have
> the
> urge to undelete something at all, but tried some stuff in order to
> be
> prepared for the worst case.
> 
> I read both HOWTOs about undeleting files on ext2 filesystems,
> which can
> be found on TLDP. But none of the mentioned methods reveal anything
> that
> was deleted on an ext3 fs.
> 
> Is it possible at all?
> 
> I created a directory structure with aproximately 1.000 directories
> and
> about 65.000 files for testing purposes. Most of the files were
> more
> than 48KB, so the more than 12 blocks dilemma would be forced upon
> me.
> Through a Nautilus FileBrowser window, I deleted the top directory
> of
> the tree and therefore all its contents along the way as well.
> 
> In order to make it worse, I rebooted the machine twice and logged
> in as
> the user who previously deleted files in his homefolder, before
> unmounting the filesystem with the "accidentally" deleted files -
> the
> filesystem in question is the /home partition (I wanted to have a
> typical setup ;).
> 
> Running debugfs and trying to find any deleted inodes as mentioned
> in
> the HOWTOs revealed none at all! Shouldn't there be like more than
> 65.000 deleted inodes by now? Even the undelete feature of mc
> didn't
> show any deleted files for the fs in question. Would I have to
> consult
> the journal of the fs in some fashion - and if, how?
> 
> Is there any chance to recover at least a fraction of the deleted
> data
> in any way in an above described scenario? There has been almost no
> writing to the filesystem, except for the logins of the user, so
> actually the data of almost all the deleted files should be still
> untouched and therefore recoverable - unless I misunderstood the
> concept
> of filesystems and their behaviour - which could be very well
> possible
> =;)
> 
> Any ideas/suggestions welcome ;)
> 
> Greetings,
> Alex
> 
> -- 
> Alexander Holst
> Hergulesse Design
> ph: +49 [0]711 887 5195
> fx: +49 [0]711 887 5196
> <alex.holst [at] hergulesse [dot] de>
> <hergulesse [at] s.netic [dot] de>
> 
> _______________________________________________
> yellowdog-general mailing list
> yellowdog-general@lists.terrasoftsolutions.com
>
http://lists.terrasoftsolutions.com/mailman/listinfo/yellowdog-general


=====
--Norberto Quintanar 

"You belong to something bigger. From birth. And your life is spent rediscovering the underlying principles, through various players -- coaches, mentors, teachers, spouses, kids. It's in your genes. Your responsibility. Destiny. Is all on you.  Lead, follow, or get out of the way."  
--Norberto Quintanar

__________________________________
Do you Yahoo!?
Free Pop-Up Blocker - Get it now
http://companion.yahoo.com/