[ale] Lessons learned with rm

Geoffrey esoteric at 3times25.net
Thu Aug 22 18:58:35 EDT 2002


James P. Kinney III wrote:
> I've been reading docs on ext3 for the past 2 days. It doesn't look like
> it has any way to undelete a file. Unless the code is modified to
> support logging of inode data on unlink, deletion on ext3 is rather
> permanent. When a file is unlinked on and ext3 file system, the inode
> data is also removed that tells which blocks are in use by which file.
> It effectively dumps them back "into the pool".
> 
> There was a blurb over on RedHat suggesting the use of LDE
> http://lde.sourceforge.com as a tool to aide in recovering from a
> deleted ext3-system file.  It's NOT for the faint of heart.

So, if one had an idea of the format of the deleted file, it would be 
possible to do a raw read on the disk in order to try and locate this 
information.  But, Drew's situation, as I recall was that he removed a 
directory or multiple directories.  This truly would be an effort.  But, 
is there some way to identify space that is not currently used.  That 
is, no inode associated with it?  You would reduce the search space 
substantially me thinks.

So, Drew, if you're still talking to me :), could you share what the 
file types were?  (text, image, wordprocessor)

We used to use a tool called fsdb to resolve such issues on SVR[34] 
machines, but I'd guess that's probably similar to LDE.

> 
> On Thu, 2002-08-22 at 16:33, Charles Marcus wrote:
> 
> 
>>This was on an ext2 partition?  Has the question been definitely answered as
>>to whether or not files can be undeleted from an ext3 partition?
>>
>>Thanks
>>
>>Charles
>>
>>
>>---
>>This message has been sent through the ALE general discussion list.
>>See http://www.ale.org/mailing-lists.shtml for more info. Problems should be 
>>sent to listmaster at ale dot org.
> 


-- 
Until later: Geoffrey		esoteric at 3times25.net

I didn't have to buy my radio from a specific company to listen
to FM, why doesn't that apply to the Internet (anymore...)?


---
This message has been sent through the ALE general discussion list.
See http://www.ale.org/mailing-lists.shtml for more info. Problems should be 
sent to listmaster at ale dot org.






More information about the Ale mailing list